create-ailk 0.26.0 → 0.28.0

package/templates/apps/web/lib/nav-label-keys.ts

@@ -0,0 +1,78 @@
+// nav-label-keys.ts — the set of `nav` message keys the site chrome resolves
+// (#10045).
+//
+// The header and footer render translated strings, but `nav-config.ts`
+// carries only message keys. Every key is looked up in the `nav` namespace by
+// name — there is no hand-written list of allowed keys — so adding a page to
+// the nav is one entry in `nav-config.ts` plus its text in
+// `messages/<locale>.json` (or the site overlay, `messages/site/<locale>.json`).
+// `scripts/check-nav-labels.ts` fails the build when a key used here is
+// missing from a locale's catalog.
+
+import { footerColumns, navItems } from "./nav-config";
+
+/**
+ * Every field on a nav-config entry that names a `nav` message key:
+ * `labelKey` (an item or action), `headingKey` (a flyout group or footer
+ * column) and `descKey` (a flyout feature's description). These are the only
+ * three key-bearing fields in `@working-theory/ui`'s chrome types.
+ */
+const KEY_FIELDS: ReadonlySet<string> = new Set([
+  "labelKey",
+  "headingKey",
+  "descKey",
+]);
+
+/**
+ * The `nav` keys the layout itself resolves by name, beside the ones
+ * `nav-config.ts` declares: the session actions, the centred footer's FAQ
+ * link and the menu controls.
+ */
+export const LAYOUT_NAV_KEYS: readonly string[] = [
+  "account",
+  "signIn",
+  "signOut",
+  "signUp",
+  "faq",
+  "openMenu",
+  "closeMenu",
+  "moreLinks",
+];
+
+/** Every key-bearing field value in the given nav configs, at any depth. */
+export function collectNavLabelKeys(
+  ...configs: readonly unknown[]
+): Set<string> {
+  const keys = new Set<string>();
+  const walk = (value: unknown): void => {
+    if (Array.isArray(value)) {
+      for (const entry of value) walk(entry);
+      return;
+    }
+    if (typeof value !== "object" || value === null) return;
+    for (const [field, child] of Object.entries(value)) {
+      if (KEY_FIELDS.has(field)) {
+        if (typeof child === "string") keys.add(child);
+      } else {
+        walk(child);
+      }
+    }
+  };
+  for (const config of configs) walk(config);
+  return keys;
+}
+
+/** The string keys of a message catalog's `nav` namespace. */
+export function navMessageKeys(catalog: unknown): string[] {
+  if (typeof catalog !== "object" || catalog === null) return [];
+  const nav = (catalog as Record<string, unknown>)["nav"];
+  if (typeof nav !== "object" || nav === null) return [];
+  return Object.entries(nav)
+    .filter(([, value]) => typeof value === "string")
+    .map(([key]) => key);
+}
+
+/** Every `nav` key the site chrome uses: `nav-config.ts`'s keys and the layout's own. */
+export function usedNavLabelKeys(): Set<string> {
+  return new Set([...collectNavLabelKeys(navItems, footerColumns), ...LAYOUT_NAV_KEYS]);
+}

package/templates/apps/web/lib/newsletter.actions.ts

@@ -32,6 +32,11 @@
  * is success; a 503 `lead_capture_not_configured` or an unreachable API
  * (status 0, 502, 504) is `unavailable`. Otherwise (a Free build has no flow
  * route) it posts `leads.subscribe`, as before.
+ *
+ * The bot check (#9255 D4): each write path runs `runBotCheck` after its
+ * consent refusal and immediately before its hub call, so one signup is
+ * checked exactly once. A bot gets the generic error and a check that cannot
+ * decide `unavailable`; neither is sent.
  */
 
 import { flows, leads, visitorForwardHeaders } from "@working-theory/api-client";
@@ -41,8 +46,9 @@ import { cookies, headers } from "next/headers";
 import { getLocale } from "next-intl/server";
 import { z } from "zod";
 
-import { checkRateLimit, clientIpFromHeaders } from "../src/lib/rate-limit";
+import { clientIpFromHeaders, takeVisitorLimit } from "../src/lib/rate-limit";
 
+import { runBotCheck } from "./bot-check";
 import { consentVisitorHeader, readConsentVisitor } from "./consent-visitor";
 import { inPageView, readServedMagnet } from "./in-page-magnet";
 
@@ -54,6 +60,8 @@ const RATE_LIMITED = "Too many signups from here. Please try again in a few minu
 // spend the bucket every visitor shares.
 const RATE_LIMIT_MAX_CALLS = 30;
 const RATE_LIMIT_WINDOW_MS = 10 * 60 * 1000;
+/** Outside a request scope there is no address: the shared bucket. */
+const NO_HEADERS = { get: () => null };
 
 /** The form's one field; zod's default message is the field error shown. */
 const newsletterFormSchema = z.object({ email: z.string().email() });
@@ -73,6 +81,18 @@ function isApiUnreachable(res: { status: number }): boolean {
   return res.status === 0 || res.status === 502 || res.status === 504;
 }
 
+/** #9255 D4 — the spoke edge's bot check; `null` to go on to the write. */
+async function botRefusal(): Promise<LeadCaptureFormState | null> {
+  const botCheck = await runBotCheck({
+    source: "bot-check",
+    target: "subscribeNewsletterAction",
+    scope: "write",
+  });
+  if (botCheck === "bot") return { kind: "error", message: GENERIC_ERROR };
+  if (botCheck === "unavailable") return { kind: "unavailable" };
+  return null;
+}
+
 /**
  * The signup through the served newsletter magnet, or `null` when it does not
  * map (absent, draft, a Free build with no flow route, or not a one-field
@@ -102,6 +122,8 @@ async function submitThroughMagnet(
     for (const purpose of consent.purposes) values[`${consent.field}.${purpose}`] = true;
   }
   const payload = { stepKey: view.stepKey, values, locale };
+  const refused = await botRefusal();
+  if (refused !== null) return refused;
   try {
     const res = init
       ? await flows.submitStep(NEWSLETTER_FLOW_SLUG, payload, init)
@@ -142,15 +164,15 @@ export async function subscribeNewsletterAction(
     // No request scope to read — no forwarding, and the visitor is "unknown".
   }
 
-  // No readable address: skip the per-visitor limit rather than put every
-  // visitor in one shared bucket (the contact action's rule).
-  const visitor = requestHeaders ? clientIpFromHeaders(requestHeaders) : "unknown";
+  // No readable address: the shared, wider bucket, never a skip (#9967 D1,
+  // the contact action's rule).
   if (
-    visitor !== "unknown" &&
-    !checkRateLimit(`newsletter:${visitor}`, RATE_LIMIT_MAX_CALLS, RATE_LIMIT_WINDOW_MS)
+    !takeVisitorLimit("newsletter", requestHeaders ?? NO_HEADERS, RATE_LIMIT_MAX_CALLS, RATE_LIMIT_WINDOW_MS)
+      .allowed
   ) {
     return { kind: "error", message: RATE_LIMITED };
   }
+  const visitor = clientIpFromHeaders(requestHeaders ?? NO_HEADERS);
 
   let init: { headers: Record<string, string> } | undefined;
   if (requestHeaders) {
@@ -179,6 +201,9 @@ export async function subscribeNewsletterAction(
   // The Free path renders the seeded config, whose consent box gates the post.
   if (!consented) return { kind: "error", fieldErrors: { consent: CONSENT_REQUIRED } };
 
+  const refused = await botRefusal();
+  if (refused !== null) return refused;
+
   const siteId = process.env.AILK_SITE_ID ?? "default";
   const body = { siteId, source: "newsletter", email: parsed.data.email };
   try {

package/templates/apps/web/lib/offerings-pricing.ts

@@ -13,7 +13,9 @@
  *   - T2 — every Stripe string is emitted as a plain text field, with format
  *     characters removed; nothing is parsed as HTML or Markdown (D8).
  *   - T3 — every link is `OFFERINGS_CHECKOUT_PATH` plus a lookup key that
- *     `parseLookupKey` accepts; no href is built from any other field (D5).
+ *     `parseLookupKey` accepts — plus, for a bundled plan, `?with=` and the
+ *     required product's key (#10028 D9); no href is built from any other
+ *     field (D5).
  *   - §3.7 — `yearly` reads as annual and `once` as one-time at render, never
  *     in the key (D2).
  *
@@ -49,6 +51,10 @@ export interface OfferingsPricingLabels {
   monthly(amount: string): string;
   annual(amount: string): string;
   oneTime(amount: string): string;
+  /** A bundled plan's phrase: its one-time phrase plus its required product's recurring phrase (#10028 D9). */
+  withRequired(plan: string, required: string): string;
+  /** A deposit plan's footnote, from the formatted deposit (#10030 D10). */
+  depositNote(deposit: string): string;
 }
 
 export interface OfferingsPricing {
@@ -69,6 +75,21 @@ export function offeringsCheckoutHref(lookupKey: string): string | null {
     : null;
 }
 
+/**
+ * The CTA target for a bundled plan (#10028 D9): the plan's key plus the
+ * required product's key as `?with=`, or `null` when either is outside the
+ * grammar. Both keys are `[a-z0-9_-]` only, so neither needs encoding.
+ */
+export function offeringsBundleHref(
+  planKey: string,
+  requiredKey: string,
+): string | null {
+  const base = offeringsCheckoutHref(planKey);
+  return base && parseLookupKey(requiredKey)
+    ? `${base}?with=${requiredKey}`
+    : null;
+}
+
 /**
  * Whether `lookupKey` is a grammar key of a Price in a current, non-empty
  * shown set — the keys `/pricing`'s cards are built from (#9051 D4).
@@ -194,6 +215,63 @@ function firstRecommended(products: OfferingsProduct[]): string | undefined {
   return products.find((p) => p.recommended)?.plan;
 }
 
+/**
+ * A bundled plan's card (#10028 D9): the plan's one-time Price with its
+ * required product's recurring Prices — one link per shown recurring
+ * interval. With monthly and yearly, the monthly link is the CTA and the
+ * yearly one the annual link, each mode phrasing both amounts; with one,
+ * that link alone and the phrase as the custom price. No card when the plan's
+ * own one-time Price, or a recurring Price of the required product, is not
+ * shown.
+ */
+function bundleCard(
+  product: OfferingsProduct,
+  required: OfferingsProduct,
+  highlighted: boolean,
+  locale: string,
+  labels: OfferingsPricingLabels,
+): PricingPlanCard | null {
+  const once = priceFor(product, PERIOD.once);
+  const monthly = priceFor(required, PERIOD.monthly);
+  const yearly = priceFor(required, PERIOD.yearly);
+  const first = monthly ?? yearly;
+  if (!once || !first) return null;
+  const href = offeringsBundleHref(once.lookupKey, first.lookupKey);
+  if (!href) return null;
+  const oneTime = phrase(once, locale, labels);
+  const combined = (recurring: OfferingsPrice) =>
+    labels.withRequired(oneTime, phrase(recurring, locale, labels));
+  const price: PricingPlanCard["price"] = {};
+  if (monthly && yearly) {
+    price.monthly = combined(monthly);
+    price.annual = combined(yearly);
+  } else {
+    price.custom = combined(first);
+  }
+  const card: PricingPlanCard = {
+    key: product.plan,
+    name: stripFormatCharacters(product.name),
+    price,
+    features: features(product),
+    cta: { label: labels.cta, href },
+  };
+  // The deposit note wins the footnote; the terms note shows only without one.
+  // NO_HAND_IMPLEMENT_OK: builder-assessors run for #10030 — the builder is the implementer.
+  if (product.deposit !== undefined)
+    card.priceFootnote = labels.depositNote(formatMinorUnits(product.deposit, once.currency, locale));
+  else if (product.termsNote)
+    card.priceFootnote = stripFormatCharacters(product.termsNote);
+  const annualHref =
+    monthly && yearly && offeringsBundleHref(once.lookupKey, yearly.lookupKey);
+  if (annualHref) card.annualCtaHref = annualHref;
+  if (highlighted) {
+    card.highlighted = true;
+    card.highlightStyle = "pill";
+    card.highlightLabel = labels.recommended;
+  }
+  return card;
+}
+
 function planCard(
   product: OfferingsProduct,
   highlighted: boolean,
@@ -227,6 +305,10 @@ function planCard(
   if (product.note) card.priceSubhead = stripFormatCharacters(product.note);
   if (product.termsNote)
     card.priceFootnote = stripFormatCharacters(product.termsNote);
+  // A deposit plan's footnote (#10030 D10), in its one-time Price's currency;
+  // it takes the footnote over a terms note (the rarer field).
+  if (product.deposit !== undefined && once)
+    card.priceFootnote = labels.depositNote(formatMinorUnits(product.deposit, once.currency, locale));
   // Annual mode shows the yearly Price only when a monthly one is beside it,
   // so only then does the card need a second link (D5, D6).
   const annualHref =
@@ -280,28 +362,75 @@ function isPresent<T>(value: T | null): value is T {
   return value !== null;
 }
 
+/**
+ * The products whose `{plan}` is in `plans`, plus every product a kept one
+ * `requires`, in the snapshot's order (#10044 D4); `plans` absent → all.
+ * One level of `requires` is followed: a required product is sold only
+ * inside its bundle and requires nothing itself (#10028 decision 6).
+ */
+function narrowToPlans(
+  offerings: OfferingsProduct[],
+  plans: readonly string[] | undefined,
+): OfferingsProduct[] {
+  if (plans === undefined) return offerings;
+  const listed = new Set(plans);
+  const kept = new Set(
+    offerings.filter((o) => listed.has(o.plan)).map((o) => o.plan),
+  );
+  for (const o of offerings) {
+    if (kept.has(o.plan) && o.requires !== undefined) kept.add(o.requires);
+  }
+  return offerings.filter((o) => kept.has(o.plan));
+}
+
 /**
  * The shown set as Pricing section data, or `null` when there is nothing to
  * show: a value the shown-set schema refuses, a snapshot that is not
  * `current`, or no offerings. Each fragment is `null` when its group is empty.
+ *
+ * `plans` (#10044 D4) narrows the set to an offering page's own products:
+ * those whose `{plan}` it lists, plus every product a kept one `requires`, in
+ * the snapshot's order. Absent, every shown product is mapped, as before.
  */
 export function offeringsPricing(
   shownSet: unknown,
-  options: { locale: string; labels: OfferingsPricingLabels },
+  options: {
+    locale: string;
+    labels: OfferingsPricingLabels;
+    plans?: readonly string[] | undefined;
+  },
 ): OfferingsPricing | null {
   const parsed = shownSetSchema.safeParse(shownSet);
   if (!parsed.success) return null;
-  const { state, offerings } = parsed.data;
-  if (state !== "current" || offerings.length === 0) return null;
+  const { state, offerings: shown } = parsed.data;
+  if (state !== "current" || shown.length === 0) return null;
   const { locale, labels } = options;
 
-  const planProducts = offerings.filter((o) => o.ailkGroup === "plan");
+  // #10028 D9 — a product some shown plan requires is sold only inside that
+  // bundle (decision 6), so it gets no card of its own. Read over the whole
+  // shown set, so a page listing only that product still shows it no card.
+  const requiredPlans = new Set(
+    shown.map((o) => o.requires).filter((plan) => plan !== undefined),
+  );
+  const offerings = narrowToPlans(shown, options.plans);
+  const planProducts = offerings.filter(
+    (o) => o.ailkGroup === "plan" && !requiredPlans.has(o.plan),
+  );
   const addonProducts = offerings.filter((o) => o.ailkGroup === "addon");
   const recommendedPlan = firstRecommended(planProducts);
   const recommendedAddon = firstRecommended(addonProducts);
 
   const plans = planProducts
-    .map((p) => planCard(p, p.plan === recommendedPlan, locale, labels))
+    .map((p) => {
+      const required =
+        p.requires === undefined
+          ? undefined
+          : offerings.find((o) => o.plan === p.requires);
+      if (p.requires !== undefined) {
+        return required ? bundleCard(p, required, p.plan === recommendedPlan, locale, labels) : null;
+      }
+      return planCard(p, p.plan === recommendedPlan, locale, labels);
+    })
     .filter(isPresent);
   const addons = addonProducts
     .map((p) => addonTile(p, p.plan === recommendedAddon, locale, labels))