create-ailk 0.4.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (396) hide show
  1. package/README.md +55 -8
  2. package/component-catalog.json +12248 -0
  3. package/component-catalog.md +193 -68
  4. package/dist/cli.js +29 -1
  5. package/dist/derive-architecture.js +5 -2
  6. package/dist/lib/api-boot-assertion.d.ts +46 -0
  7. package/dist/lib/api-boot-assertion.js +70 -0
  8. package/dist/lib/extract-module-bundle.d.ts +50 -2
  9. package/dist/lib/extract-module-bundle.js +223 -15
  10. package/dist/lib/fetch-guard.d.ts +28 -0
  11. package/dist/lib/fetch-guard.js +101 -0
  12. package/dist/lib/fetch-module.js +4 -0
  13. package/dist/lib/fetch-template.js +4 -0
  14. package/dist/lib/import-graph.d.ts +29 -0
  15. package/dist/lib/import-graph.js +140 -0
  16. package/dist/module-architecture.d.ts +60 -8
  17. package/dist/module-architecture.js +587 -242
  18. package/dist/parse-args.js +6 -2
  19. package/dist/programmatic.d.ts +10 -0
  20. package/dist/programmatic.js +134 -19
  21. package/dist/site-chrome.d.ts +80 -0
  22. package/dist/site-chrome.js +135 -0
  23. package/dist/surfaces.d.ts +21 -6
  24. package/dist/surfaces.js +209 -36
  25. package/dist/template-manifest.d.ts +88 -3
  26. package/dist/template-manifest.js +281 -29
  27. package/dist/template-names.d.ts +1 -1
  28. package/dist/template-names.js +2 -0
  29. package/package.json +10 -2
  30. package/site-templates/_base/ailk-template.json +6 -0
  31. package/site-templates/_base/content/en/Pricing/pricing.mdx +169 -0
  32. package/site-templates/marketing-site/TEMPLATE-MANIFEST.json +351 -0
  33. package/site-templates/marketing-site/TEMPLATE-MANIFEST.md +400 -0
  34. package/site-templates/marketing-site/ailk-template.json +11 -0
  35. package/site-templates/marketing-site/content/en/blog/05-this-vc-morning-routine-will-make-you-super-annoying.mdx +36 -0
  36. package/site-templates/marketing-site/provenance.json +4 -0
  37. package/site-templates/marketing-site-free/TEMPLATE-MANIFEST.json +288 -0
  38. package/site-templates/marketing-site-free/TEMPLATE-MANIFEST.md +286 -0
  39. package/site-templates/marketing-site-free/ailk-template.json +2 -1
  40. package/site-templates/minimalism-site/TEMPLATE-MANIFEST.json +279 -0
  41. package/site-templates/minimalism-site/TEMPLATE-MANIFEST.md +336 -0
  42. package/site-templates/minimalism-site/ailk-template.json +22 -0
  43. package/site-templates/minimalism-site/assets/avatar-placeholder-1.svg +7 -0
  44. package/site-templates/minimalism-site/assets/avatar-placeholder-2.svg +7 -0
  45. package/site-templates/minimalism-site/assets/avatar-placeholder-3.svg +7 -0
  46. package/site-templates/minimalism-site/assets/avatar-placeholder-4.svg +7 -0
  47. package/site-templates/minimalism-site/assets/avatar-placeholder-5.svg +7 -0
  48. package/site-templates/minimalism-site/assets/avatar-placeholder-6.svg +7 -0
  49. package/site-templates/minimalism-site/assets/hero-backdrop.svg +17 -0
  50. package/site-templates/minimalism-site/assets/logo-placeholder-1.svg +6 -0
  51. package/site-templates/minimalism-site/assets/logo-placeholder-2.svg +6 -0
  52. package/site-templates/minimalism-site/assets/logo-placeholder-3.svg +6 -0
  53. package/site-templates/minimalism-site/assets/wordmark-placeholder.svg +28 -0
  54. package/site-templates/minimalism-site/content/en/AboutPage/about.mdx +110 -0
  55. package/site-templates/minimalism-site/content/en/ContactPage/contact.mdx +68 -0
  56. package/site-templates/minimalism-site/content/en/FAQPage/faq.mdx +57 -0
  57. package/site-templates/minimalism-site/content/en/HomePage/home.mdx +244 -0
  58. package/site-templates/minimalism-site/content/en/LandingPage/referral.mdx +77 -0
  59. package/site-templates/minimalism-site/content/en/LandingPage/reports.mdx +73 -0
  60. package/site-templates/minimalism-site/content/en/ReportPage/annual-letter-2024.mdx +52 -0
  61. package/site-templates/minimalism-site/content/en/ReportPage/field-notes-2023.mdx +52 -0
  62. package/site-templates/minimalism-site/content/en/ReportPage/platform-shift-2025.mdx +52 -0
  63. package/site-templates/minimalism-site/content/en/ReportPage/state-of-the-market-2026.mdx +52 -0
  64. package/site-templates/minimalism-site/content/en/Service/first-engagement.mdx +38 -0
  65. package/site-templates/minimalism-site/content/en/Service/second-engagement.mdx +38 -0
  66. package/site-templates/minimalism-site/content/en/Service/third-engagement.mdx +38 -0
  67. package/site-templates/minimalism-site/content/en/ServicesList/services.mdx +73 -0
  68. package/site-templates/minimalism-site/flows/referral.flow.json +71 -0
  69. package/site-templates/minimalism-site/provenance.json +4 -0
  70. package/site-templates/saas-product/TEMPLATE-MANIFEST.md +61 -0
  71. package/site-templates/saas-product/ailk-template.json +16 -0
  72. package/site-templates/saas-product/provenance.json +10 -0
  73. package/site-templates/simple-service/TEMPLATE-MANIFEST.json +240 -0
  74. package/site-templates/simple-service/TEMPLATE-MANIFEST.md +278 -0
  75. package/site-templates/simple-service/ailk-template.json +10 -0
  76. package/site-templates/simple-service/content/en/AboutPage/about.mdx +38 -0
  77. package/site-templates/simple-service/content/en/ContactPage/contact.mdx +67 -0
  78. package/site-templates/simple-service/content/en/FAQPage/faq.mdx +56 -0
  79. package/site-templates/simple-service/content/en/HomePage/home.mdx +85 -0
  80. package/site-templates/simple-service/content/en/Service/landscape-design.mdx +40 -0
  81. package/site-templates/simple-service/content/en/Service/lawn-maintenance.mdx +40 -0
  82. package/site-templates/simple-service/content/en/Service/seasonal-cleanup.mdx +40 -0
  83. package/site-templates/simple-service/content/en/ServicesList/services.mdx +72 -0
  84. package/site-templates/simple-service/provenance.json +4 -0
  85. package/templates/.claude/skills/README.md +16 -25
  86. package/templates/.env.example +102 -12
  87. package/templates/.github/workflows/ci.yml +48 -0
  88. package/templates/README.md +3 -1
  89. package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-31.552Z-fallback-1789916251590-037e9005.json +8 -0
  90. package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-33.840Z-fallback-1789916253842-b52659e9.json +12 -0
  91. package/templates/apps/api/.ailk/inbox/2026-09-20T14-57-33.844Z-fallback-1789916253845-6b266f8c.json +12 -0
  92. package/templates/apps/api/.env.example +13 -0
  93. package/templates/apps/api/CLAUDE.md +29 -2
  94. package/templates/apps/api/eslint.config.mjs +69 -0
  95. package/templates/apps/api/jest.config.cjs +3 -0
  96. package/templates/apps/api/package.json +7 -2
  97. package/templates/apps/api/src/__tests__/commerce-claim-registration.test.ts +407 -0
  98. package/templates/apps/api/src/__tests__/module-exclusion.test.ts +89 -9
  99. package/templates/apps/api/src/__tests__/review-surface-registration.test.ts +167 -0
  100. package/templates/apps/api/src/__tests__/server.test.ts +471 -0
  101. package/templates/apps/api/src/__tests__/vercel-handler.test.ts +45 -0
  102. package/templates/apps/api/src/__tests__/workspace-module-registration.test.ts +10 -1
  103. package/templates/apps/api/src/config/index.ts +62 -0
  104. package/templates/apps/api/src/config/modules.ts +7 -3
  105. package/templates/apps/api/src/lib/__mocks__/prisma.ts +241 -2
  106. package/templates/apps/api/src/lib/__tests__/auth-email-budget.test.ts +143 -0
  107. package/templates/apps/api/src/lib/__tests__/content-adapter.test.ts +23 -0
  108. package/templates/apps/api/src/lib/__tests__/deliverable-asset-store.test.ts +125 -0
  109. package/templates/apps/api/src/lib/__tests__/error-serializer.test.ts +20 -0
  110. package/templates/apps/api/src/lib/__tests__/require-commerce-claim.test.ts +317 -0
  111. package/templates/apps/api/src/lib/__tests__/site.test.ts +238 -0
  112. package/templates/apps/api/src/lib/__tests__/stripe.test.ts +75 -0
  113. package/templates/apps/api/src/lib/auth-email-budget.ts +160 -0
  114. package/templates/apps/api/src/lib/content-adapter.ts +57 -31
  115. package/templates/apps/api/src/lib/deliverable-asset-store.ts +76 -0
  116. package/templates/apps/api/src/lib/error-serializer.ts +23 -3
  117. package/templates/apps/api/src/lib/outbound-http.ts +7 -2
  118. package/templates/apps/api/src/lib/require-commerce-claim.ts +250 -0
  119. package/templates/apps/api/src/lib/site.ts +208 -9
  120. package/templates/apps/api/src/lib/stripe.ts +66 -0
  121. package/templates/apps/api/src/middleware/__tests__/default-tenant.test.ts +521 -0
  122. package/templates/apps/api/src/middleware/__tests__/rate-limit.test.ts +150 -0
  123. package/templates/apps/api/src/middleware/default-tenant.ts +136 -0
  124. package/templates/apps/api/src/middleware/rate-limit.ts +7 -1
  125. package/templates/apps/api/src/openapi/spec.ts +543 -2
  126. package/templates/apps/api/src/routes/auth/__tests__/auth-user.functional.test.ts +48 -0
  127. package/templates/apps/api/src/routes/auth/__tests__/transactional-email.test.ts +309 -0
  128. package/templates/apps/api/src/routes/auth/__tests__/user.test.ts +123 -0
  129. package/templates/apps/api/src/routes/auth/transactional-email.ts +273 -0
  130. package/templates/apps/api/src/routes/auth/user.ts +61 -0
  131. package/templates/apps/api/src/routes/checkout/__tests__/session.test.ts +434 -0
  132. package/templates/apps/api/src/routes/checkout/__tests__/sessions.test.ts +888 -0
  133. package/templates/apps/api/src/routes/checkout/index.ts +34 -0
  134. package/templates/apps/api/src/routes/checkout/session.ts +139 -0
  135. package/templates/apps/api/src/routes/checkout/sessions.ts +197 -0
  136. package/templates/apps/api/src/routes/content/__tests__/get-page.test.ts +554 -0
  137. package/templates/apps/api/src/routes/content/__tests__/list-pages.test.ts +108 -0
  138. package/templates/apps/api/src/routes/content/__tests__/search.test.ts +450 -0
  139. package/templates/apps/api/src/routes/content/get-page.ts +94 -12
  140. package/templates/apps/api/src/routes/content/index.ts +13 -73
  141. package/templates/apps/api/src/routes/content/list-pages.ts +15 -3
  142. package/templates/apps/api/src/routes/content/rate-limit.ts +15 -6
  143. package/templates/apps/api/src/routes/content/search.ts +129 -0
  144. package/templates/apps/api/src/routes/leads/__tests__/index.test.ts +447 -31
  145. package/templates/apps/api/src/routes/leads/__tests__/list.test.ts +171 -0
  146. package/templates/apps/api/src/routes/leads/index.ts +100 -13
  147. package/templates/apps/api/src/routes/leads/list.ts +104 -0
  148. package/templates/apps/api/src/routes/project-listings/__tests__/configured-application.test.ts +51 -0
  149. package/templates/apps/api/src/routes/project-listings/__tests__/drafts.test.ts +351 -0
  150. package/templates/apps/api/src/routes/project-listings/__tests__/founder-identity.test.ts +51 -0
  151. package/templates/apps/api/src/routes/project-listings/__tests__/me.test.ts +5 -2
  152. package/templates/apps/api/src/routes/project-listings/__tests__/public.test.ts +4 -1
  153. package/templates/apps/api/src/routes/project-listings/__tests__/resume-email.test.ts +58 -0
  154. package/templates/apps/api/src/routes/project-listings/__tests__/site-answers.test.ts +107 -6
  155. package/templates/apps/api/src/routes/project-listings/__tests__/site-key.test.ts +87 -2
  156. package/templates/apps/api/src/routes/project-listings/__tests__/structured-address.test.ts +51 -0
  157. package/templates/apps/api/src/routes/project-listings/start.ts +5 -1
  158. package/templates/apps/api/src/routes/requests/__tests__/confirm.test.ts +686 -0
  159. package/templates/apps/api/src/routes/requests/confirm.ts +601 -0
  160. package/templates/apps/api/src/routes/requests/index.ts +54 -0
  161. package/templates/apps/api/src/routes/webhooks/README.md +265 -0
  162. package/templates/apps/api/src/routes/webhooks/__tests__/stripe-dunning.test.ts +749 -0
  163. package/templates/apps/api/src/routes/webhooks/__tests__/stripe-flow-checkout.test.ts +330 -0
  164. package/templates/apps/api/src/routes/webhooks/__tests__/stripe-idempotency.test.ts +262 -0
  165. package/templates/apps/api/src/routes/webhooks/__tests__/stripe-org-billing.test.ts +285 -0
  166. package/templates/apps/api/src/routes/webhooks/__tests__/stripe-rate-limit.test.ts +213 -0
  167. package/templates/apps/api/src/routes/webhooks/__tests__/stripe-request-paid.test.ts +301 -0
  168. package/templates/apps/api/src/routes/webhooks/__tests__/stripe.test.ts +648 -0
  169. package/templates/apps/api/src/routes/webhooks/index.ts +89 -0
  170. package/templates/apps/api/src/routes/webhooks/stripe.ts +1399 -0
  171. package/templates/apps/api/src/server.ts +521 -55
  172. package/templates/apps/api/src/services/__tests__/abandon-email.test.ts +39 -0
  173. package/templates/apps/api/src/services/__tests__/aeo-score.test.ts +217 -40
  174. package/templates/apps/api/src/services/__tests__/audit-log.test.ts +620 -0
  175. package/templates/apps/api/src/services/__tests__/consent.test.ts +2 -0
  176. package/templates/apps/api/src/services/__tests__/deliverable-fulfillment.test.ts +300 -5
  177. package/templates/apps/api/src/services/__tests__/deliverable-resend.test.ts +20 -0
  178. package/templates/apps/api/src/services/__tests__/dunning-policy.test.ts +368 -0
  179. package/templates/apps/api/src/services/__tests__/lead-promotion.test.ts +408 -0
  180. package/templates/apps/api/src/services/__tests__/lead-routing.test.ts +160 -0
  181. package/templates/apps/api/src/services/__tests__/leads-inbox.test.ts +329 -0
  182. package/templates/apps/api/src/services/__tests__/listing-config.test.ts +166 -0
  183. package/templates/apps/api/src/services/__tests__/project-listings.fence.test.ts +154 -0
  184. package/templates/apps/api/src/services/__tests__/public-site-resolver.test.ts +137 -0
  185. package/templates/apps/api/src/services/__tests__/request-confirm.test.ts +444 -0
  186. package/templates/apps/api/src/services/__tests__/revalidation.test.ts +238 -0
  187. package/templates/apps/api/src/services/__tests__/verified-email.test.ts +78 -0
  188. package/templates/apps/api/src/services/abandon-email.ts +8 -2
  189. package/templates/apps/api/src/services/aeo-score.ts +49 -12
  190. package/templates/apps/api/src/services/audit-log.ts +668 -0
  191. package/templates/apps/api/src/services/consent.ts +18 -0
  192. package/templates/apps/api/src/services/default-tenant.ts +300 -0
  193. package/templates/apps/api/src/services/deliverable-fulfillment.ts +141 -13
  194. package/templates/apps/api/src/services/dunning-policy.ts +294 -0
  195. package/templates/apps/api/src/services/entitlements.ts +80 -0
  196. package/templates/apps/api/src/services/lead-promotion.ts +160 -0
  197. package/templates/apps/api/src/services/lead-routing.ts +161 -2
  198. package/templates/apps/api/src/services/leads-inbox.ts +284 -0
  199. package/templates/apps/api/src/services/listing-config.ts +27 -9
  200. package/templates/apps/api/src/services/owner-workspaces.ts +132 -0
  201. package/templates/apps/api/src/services/project-listings.ts +201 -6
  202. package/templates/apps/api/src/services/public-site-resolver.ts +106 -0
  203. package/templates/apps/api/src/services/request-confirm.ts +646 -0
  204. package/templates/apps/api/src/services/revalidation.ts +173 -0
  205. package/templates/apps/api/src/services/verified-email.ts +71 -0
  206. package/templates/apps/api/src/vercel-handler.ts +75 -35
  207. package/templates/apps/mcp/.env.example +17 -0
  208. package/templates/apps/mcp/CLAUDE.md +58 -25
  209. package/templates/apps/mcp/__tests__/aeo-cli-parity.test.ts +6 -0
  210. package/templates/apps/mcp/__tests__/audit.test.ts +137 -8
  211. package/templates/apps/mcp/__tests__/catalog-drift.test.ts +79 -36
  212. package/templates/apps/mcp/__tests__/get_offerings.test.ts +111 -2
  213. package/templates/apps/mcp/__tests__/get_pricing.test.ts +82 -2
  214. package/templates/apps/mcp/__tests__/http-transport.test.ts +541 -2
  215. package/templates/apps/mcp/__tests__/index.test.ts +39 -0
  216. package/templates/apps/mcp/__tests__/lib/audit-single-page-readiness-scan.test.ts +143 -0
  217. package/templates/apps/mcp/__tests__/lib/commerce-claim.test.ts +111 -0
  218. package/templates/apps/mcp/__tests__/lib/content-adapter-parity.test.ts +65 -0
  219. package/templates/apps/mcp/__tests__/lib/content-adapter.test.ts +188 -0
  220. package/templates/apps/mcp/__tests__/lib/fail-closed-tools.test.ts +165 -0
  221. package/templates/apps/mcp/__tests__/lib/public-workspace.test.ts +124 -0
  222. package/templates/apps/mcp/__tests__/list_pages.test.ts +116 -0
  223. package/templates/apps/mcp/__tests__/module-exclusion.test.ts +7 -1
  224. package/templates/apps/mcp/__tests__/parity.test.ts +12 -9
  225. package/templates/apps/mcp/__tests__/purchase-disabled.test.ts +89 -22
  226. package/templates/apps/mcp/__tests__/read_content.test.ts +322 -1
  227. package/templates/apps/mcp/__tests__/search_content.test.ts +105 -2
  228. package/templates/apps/mcp/__tests__/server.test.ts +67 -14
  229. package/templates/apps/mcp/__tests__/start_purchase.test.ts +252 -0
  230. package/templates/apps/mcp/__tests__/tools/{scaffold.test.ts → create_project.test.ts} +23 -23
  231. package/templates/apps/mcp/__tests__/tools/purchase.test.ts +300 -123
  232. package/templates/apps/mcp/eslint.config.mjs +69 -0
  233. package/templates/apps/mcp/jest.config.cjs +13 -0
  234. package/templates/apps/mcp/package.json +8 -2
  235. package/templates/apps/mcp/src/abuse/index.ts +159 -24
  236. package/templates/apps/mcp/src/config/modules.ts +10 -5
  237. package/templates/apps/mcp/src/http-transport.ts +102 -29
  238. package/templates/apps/mcp/src/index.ts +73 -11
  239. package/templates/apps/mcp/src/lib/audit-single-page.ts +90 -3
  240. package/templates/apps/mcp/src/lib/commerce-claim.ts +94 -0
  241. package/templates/apps/mcp/src/lib/content-adapter.ts +113 -0
  242. package/templates/apps/mcp/src/lib/empty-content-adapter.ts +139 -0
  243. package/templates/apps/mcp/src/lib/prisma.ts +39 -0
  244. package/templates/apps/mcp/src/lib/public-workspace.ts +133 -0
  245. package/templates/apps/mcp/src/lib/stripe-tax-signal.ts +59 -0
  246. package/templates/apps/mcp/src/server.ts +61 -37
  247. package/templates/apps/mcp/src/tools/audit.ts +26 -2
  248. package/templates/apps/mcp/src/tools/{scaffold.ts → create_project.ts} +3 -3
  249. package/templates/apps/mcp/src/tools/get_business_hours.ts +4 -3
  250. package/templates/apps/mcp/src/tools/get_faq.ts +4 -3
  251. package/templates/apps/mcp/src/tools/get_locations.ts +5 -3
  252. package/templates/apps/mcp/src/tools/get_offerings.ts +16 -4
  253. package/templates/apps/mcp/src/tools/get_pricing.ts +25 -6
  254. package/templates/apps/mcp/src/tools/get_site_info.ts +4 -3
  255. package/templates/apps/mcp/src/tools/index.ts +9 -7
  256. package/templates/apps/mcp/src/tools/list_pages.ts +4 -3
  257. package/templates/apps/mcp/src/tools/purchase.ts +128 -45
  258. package/templates/apps/mcp/src/tools/read_content.ts +20 -6
  259. package/templates/apps/mcp/src/tools/search_content.ts +11 -4
  260. package/templates/apps/web/.env.example +74 -8
  261. package/templates/apps/web/CLAUDE.md +46 -0
  262. package/templates/apps/web/app/.well-known/mcp.json/build-manifest.ts +18 -2
  263. package/templates/apps/web/app/.well-known/mcp.json/route.ts +11 -3
  264. package/templates/apps/web/app/[locale]/(auth)/__tests__/auth-pages.test.tsx +282 -0
  265. package/templates/apps/web/app/[locale]/(auth)/__tests__/password-reset.test.tsx +515 -0
  266. package/templates/apps/web/app/[locale]/(auth)/forgot-password/forgot-password-card.tsx +89 -0
  267. package/templates/apps/web/app/[locale]/(auth)/forgot-password/page.tsx +109 -0
  268. package/templates/apps/web/app/[locale]/(auth)/layout.tsx +92 -0
  269. package/templates/apps/web/app/[locale]/(auth)/reset-password/page.tsx +135 -0
  270. package/templates/apps/web/app/[locale]/(auth)/reset-password/reset-password-card.tsx +109 -0
  271. package/templates/apps/web/app/[locale]/{sign-in → (auth)/sign-in}/__tests__/page.test.tsx +48 -2
  272. package/templates/apps/web/app/[locale]/{sign-in → (auth)/sign-in}/page.tsx +20 -6
  273. package/templates/apps/web/app/[locale]/(auth)/sign-in/sign-in-card.tsx +125 -0
  274. package/templates/apps/web/app/[locale]/(auth)/sign-up/page.tsx +96 -0
  275. package/templates/apps/web/app/[locale]/(auth)/sign-up/sign-up-card.tsx +101 -0
  276. package/templates/apps/web/app/[locale]/(auth)/use-auth-card-flow.ts +102 -0
  277. package/templates/apps/web/app/[locale]/(auth)/verify-email/page.tsx +87 -0
  278. package/templates/apps/web/app/[locale]/(authed)/__tests__/gate.test.tsx +20 -10
  279. package/templates/apps/web/app/[locale]/(authed)/account/__tests__/page.test.tsx +84 -0
  280. package/templates/apps/web/app/[locale]/(authed)/account/actions.ts +58 -0
  281. package/templates/apps/web/app/[locale]/(authed)/account/page.tsx +67 -14
  282. package/templates/apps/web/app/[locale]/(authed)/layout.tsx +19 -2
  283. package/templates/apps/web/app/[locale]/(authed)/leads/__tests__/page.test.tsx +181 -0
  284. package/templates/apps/web/app/[locale]/(authed)/leads/components/LeadsTable.tsx +137 -0
  285. package/templates/apps/web/app/[locale]/(authed)/leads/page.tsx +111 -0
  286. package/templates/apps/web/app/[locale]/(authed)/sign-in-gate.tsx +1 -1
  287. package/templates/apps/web/app/[locale]/[slug]/__tests__/page.test.tsx +111 -0
  288. package/templates/apps/web/app/[locale]/[slug]/page.tsx +65 -0
  289. package/templates/apps/web/app/[locale]/cancellation/page.tsx +44 -0
  290. package/templates/apps/web/app/[locale]/flows/[slug]/FlowStepperClient.tsx +1 -1
  291. package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/FlowStepperClient.permalink.test.tsx +1 -1
  292. package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/FlowStepperClient.test.tsx +6 -5
  293. package/templates/apps/web/app/[locale]/flows/[slug]/flow.actions.ts +1 -1
  294. package/templates/apps/web/app/[locale]/layout.tsx +308 -65
  295. package/templates/apps/web/app/[locale]/purchase/__tests__/cancel.test.tsx +162 -0
  296. package/templates/apps/web/app/[locale]/purchase/__tests__/module-scope.test.ts +68 -0
  297. package/templates/apps/web/app/[locale]/purchase/__tests__/success.test.tsx +361 -0
  298. package/templates/apps/web/app/[locale]/purchase/cancel/page.tsx +115 -0
  299. package/templates/apps/web/app/[locale]/purchase/success/page.tsx +307 -0
  300. package/templates/apps/web/app/[locale]/returns/page.tsx +44 -0
  301. package/templates/apps/web/app/[locale]/shipping/page.tsx +44 -0
  302. package/templates/apps/web/app/api/revalidate/__tests__/route.test.ts +670 -0
  303. package/templates/apps/web/app/api/revalidate/route.ts +194 -0
  304. package/templates/apps/web/auth.ts +407 -8
  305. package/templates/apps/web/components/google-analytics.tsx +18 -1
  306. package/templates/apps/web/eslint.config.mjs +69 -0
  307. package/templates/apps/web/jest.config.cjs +15 -19
  308. package/templates/apps/web/lib/__tests__/auth-email.test.ts +214 -0
  309. package/templates/apps/web/lib/__tests__/auth-routes.test.ts +74 -0
  310. package/templates/apps/web/lib/__tests__/meeting-slugs.test.ts +72 -0
  311. package/templates/apps/web/lib/__tests__/structured-data.test.tsx +50 -6
  312. package/templates/apps/web/lib/auth-email.ts +318 -0
  313. package/templates/apps/web/lib/auth-env.ts +85 -0
  314. package/templates/apps/web/lib/auth-routes.ts +55 -0
  315. package/templates/apps/web/lib/meeting-slugs.ts +53 -0
  316. package/templates/apps/web/lib/nav-config.ts +27 -7
  317. package/templates/apps/web/lib/server-api.ts +1 -1
  318. package/templates/apps/web/lib/site-chrome.ts +29 -0
  319. package/templates/apps/web/lib/telemetry-scrub.ts +50 -0
  320. package/templates/apps/web/messages/en.json +216 -2
  321. package/templates/apps/web/next.config.mjs +20 -0
  322. package/templates/apps/web/package.json +8 -3
  323. package/templates/apps/web/sentry.client.config.ts +131 -0
  324. package/templates/apps/web/sentry.edge.config.ts +72 -0
  325. package/templates/apps/web/sentry.server.config.ts +72 -0
  326. package/templates/apps/web/src/lib/commerce-claim.ts +33 -0
  327. package/templates/apps/web/src/lib/commerce-sections.ts +61 -0
  328. package/templates/apps/web/src/lib/routes.ts +13 -18
  329. package/templates/brand_assets/README.md +24 -0
  330. package/templates/content/en/AboutPage/about.mdx +160 -15
  331. package/templates/content/en/CancellationPolicyPage/cancellation.mdx +108 -0
  332. package/templates/content/en/ContactPage/contact.mdx +90 -13
  333. package/templates/content/en/FAQPage/faq.mdx +62 -22
  334. package/templates/content/en/HomePage/home.mdx +244 -20
  335. package/templates/content/en/LandingPage/blog.mdx +83 -0
  336. package/templates/content/en/LandingPage/features.mdx +103 -0
  337. package/templates/content/en/LandingPage/how-it-works.mdx +143 -0
  338. package/templates/content/en/ReturnsPolicyPage/returns.mdx +108 -0
  339. package/templates/content/en/ShippingPolicyPage/shipping.mdx +108 -0
  340. package/templates/database/CHANGELOG.md +149 -0
  341. package/templates/database/README.md +10 -3
  342. package/templates/database/__tests__/appointment.db.test.ts +106 -0
  343. package/templates/database/__tests__/artifact-content-store.db.test.ts +316 -0
  344. package/templates/database/__tests__/composite-fence.db.test.ts +206 -0
  345. package/templates/database/__tests__/fence-fan-out.db.test.ts +711 -0
  346. package/templates/database/__tests__/fixtures/appointment-create-probe.ts +79 -0
  347. package/templates/database/__tests__/fixtures/project-listing-consent-probe.ts +100 -0
  348. package/templates/database/__tests__/flow-workspace-key.db.test.ts +263 -0
  349. package/templates/database/__tests__/prefixed-ids.db.test.ts +85 -9
  350. package/templates/database/__tests__/project-listing-consent-at.db.test.ts +111 -0
  351. package/templates/database/__tests__/seed.test.ts +1 -1
  352. package/templates/database/__tests__/tenancy.test.ts +141 -0
  353. package/templates/database/config/schema.prisma +79 -2
  354. package/templates/database/content/schema.prisma +87 -11
  355. package/templates/database/eslint.config.mjs +69 -0
  356. package/templates/database/inbox/schema.prisma +452 -9
  357. package/templates/database/jest.config.cjs +5 -3
  358. package/templates/database/migrations/20260915120000_project_listing_solution/migration.sql +15 -0
  359. package/templates/database/migrations/20260916120000_artifact_content_store/migration.sql +158 -0
  360. package/templates/database/migrations/20260917120000_callback_request_confirm/migration.sql +40 -0
  361. package/templates/database/migrations/20260918120000_add_appointment/migration.sql +67 -0
  362. package/templates/database/migrations/20260918120000_asset_metadata_columns/migration.sql +70 -0
  363. package/templates/database/migrations/20260919120000_flow_workspace_key/migration.sql +181 -0
  364. package/templates/database/migrations/20260919130000_flow_definition_admin_columns/migration.sql +172 -0
  365. package/templates/database/migrations/20260919130000_workspace_meetings/migration.sql +41 -0
  366. package/templates/database/migrations/20260919140000_inbox_workspace_key/migration.sql +185 -0
  367. package/templates/database/migrations/20260920120000_lead_handled_at/migration.sql +70 -0
  368. package/templates/database/migrations/20260920130000_lead_workspace_source_index/migration.sql +57 -0
  369. package/templates/database/migrations/20260921120000_deliverable_grant_workspace_key/migration.sql +68 -0
  370. package/templates/database/migrations/20260922120000_tenancy_fence/migration.sql +1067 -0
  371. package/templates/database/migrations/20260923120000_listing_capturing_magnet/migration.sql +210 -0
  372. package/templates/database/package.json +7 -3
  373. package/templates/database/seed.ts +1 -1
  374. package/templates/database/tenancy.ts +86 -1
  375. package/templates/database/tsconfig.json +1 -0
  376. package/templates/package.json +1 -14
  377. package/versions.json +52 -0
  378. package/site-templates/marketing-site-free/content/en/Pricing/pricing.mdx +0 -103
  379. package/templates/apps/api/src/routes/content/__tests__/create.test.ts +0 -253
  380. package/templates/apps/api/src/routes/content/__tests__/delete.test.ts +0 -215
  381. package/templates/apps/api/src/routes/content/__tests__/update.test.ts +0 -266
  382. package/templates/apps/api/src/routes/content/create.ts +0 -115
  383. package/templates/apps/api/src/routes/content/delete.ts +0 -82
  384. package/templates/apps/api/src/routes/content/update.ts +0 -112
  385. package/templates/apps/mcp/__tests__/create_page.test.ts +0 -202
  386. package/templates/apps/mcp/__tests__/delete_page.test.ts +0 -177
  387. package/templates/apps/mcp/__tests__/update_page.test.ts +0 -196
  388. package/templates/apps/mcp/src/tools/create_page.ts +0 -96
  389. package/templates/apps/mcp/src/tools/delete_page.ts +0 -74
  390. package/templates/apps/mcp/src/tools/update_page.ts +0 -92
  391. package/templates/apps/web/app/[locale]/sign-in/sign-in-card.tsx +0 -123
  392. /package/site-templates/{marketing-site-free → _base}/content/en/PrivacyPage/privacy.mdx +0 -0
  393. /package/site-templates/{marketing-site-free → _base}/content/en/TermsPage/terms.mdx +0 -0
  394. /package/templates/apps/web/app/[locale]/{sign-in → (auth)/sign-in}/__tests__/next-path.test.ts +0 -0
  395. /package/templates/apps/web/app/[locale]/{sign-in → (auth)/sign-in}/next-path.ts +0 -0
  396. /package/templates/apps/web/{src/components → components}/SiteNav.tsx +0 -0
@@ -0,0 +1,330 @@
1
+ /**
2
+ * POST /api/webhooks/stripe — the recommender FlowCheckout stamp (#4838).
3
+ *
4
+ * The stripe.test.ts mock shape: `@working-theory/analytics/server` `track`,
5
+ * the prisma auto-mock, `@working-theory/stripe-client`'s
6
+ * `verifyWebhookSignature` at the package boundary. AC-1 … AC-5. The four
7
+ * pre-existing webhook suites are the regression floor and are not edited.
8
+ * AC-6 (#4862) adds the `no_payment_required` (zero-due) case.
9
+ */
10
+ import type { FastifyInstance } from "fastify";
11
+ import Fastify from "fastify";
12
+
13
+ const mockTrack = jest.fn().mockResolvedValue(undefined);
14
+ // Commerce claim (D-64, #5796): the receiver is a base-tree primitive gated on
15
+ // the JWT `commerce` claim, so every case in this file is a COMMERCE-CLAIMED
16
+ // deployment — which is what each one was already asserting before the gate
17
+ // existed. The unclaimed matrix lives in
18
+ // `src/__tests__/commerce-claim-registration.test.ts`.
19
+ jest.mock("@working-theory/license", () => ({
20
+ checkLicense: jest.fn().mockResolvedValue({
21
+ tier: "pro",
22
+ plan: "pro-monthly",
23
+ features: ["commerce"],
24
+ expiresAt: null,
25
+ revoked: false,
26
+ }),
27
+ }));
28
+
29
+ jest.mock("@working-theory/analytics/server", () => ({
30
+ track: (...args: unknown[]) => mockTrack(...args),
31
+ }));
32
+
33
+ // eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
34
+ jest.mock("../../../lib/prisma.js");
35
+
36
+ const mockVerifyWebhookSignature = jest.fn();
37
+ class MockStripeWebhookSignatureError extends Error {
38
+ constructor(message: string) {
39
+ super(message);
40
+ this.name = "StripeWebhookSignatureError";
41
+ }
42
+ }
43
+ jest.mock("@working-theory/stripe-client", () => ({
44
+ verifyWebhookSignature: (...args: unknown[]) => mockVerifyWebhookSignature(...args),
45
+ StripeWebhookSignatureError: MockStripeWebhookSignatureError,
46
+ assertSandboxKey: jest.fn(),
47
+ createCheckoutSession: jest.fn(),
48
+ getStripeClient: jest.fn(),
49
+ STRIPE_API_VERSION: "2024-06-20",
50
+ StripeConfigError: class StripeConfigError extends Error {},
51
+ UnknownProductCodeError: class UnknownProductCodeError extends Error {},
52
+ WEBHOOK_TOLERANCE_SECONDS: 300,
53
+ }));
54
+
55
+ import * as configModule from "../../../config/index.js";
56
+ import { stripeWebhookHandler } from "../stripe.js";
57
+ import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
58
+ import { prisma } from "../../../lib/prisma.js";
59
+
60
+ // ── Helpers ──────────────────────────────────────────────────────────────────
61
+
62
+ const FLOW_CHECKOUT_ID = "flchk_test_1";
63
+ const SESSION_ID = "cs_test_session_12345678901234567890";
64
+ const CUSTOMER_ID = "cus_test_12345678901234567890";
65
+ const EMAIL = "alice@example.com";
66
+ const PERMALINK = "eyJ2ZXJzaW9uIjoxLCJmbG93U2x1ZyI6ImFpbGstcmVjbyJ9";
67
+
68
+ function sessionEvent(type: "checkout.session.completed" | "checkout.session.expired", object: Record<string, unknown> = {}) {
69
+ return {
70
+ id: "evt_test_12345678abcdef",
71
+ type,
72
+ data: {
73
+ object: {
74
+ id: SESSION_ID,
75
+ payment_status: "paid",
76
+ amount_total: 24900,
77
+ currency: "usd",
78
+ customer: CUSTOMER_ID,
79
+ customer_details: { email: EMAIL },
80
+ metadata: { flowCheckoutId: FLOW_CHECKOUT_ID, flowSlug: "ailk-reco", offerKey: "pro", permalink: PERMALINK },
81
+ ...object,
82
+ },
83
+ },
84
+ };
85
+ }
86
+
87
+ type LogCall = [unknown, string?];
88
+ const logCalls: LogCall[] = [];
89
+
90
+ async function buildTestServer(): Promise<FastifyInstance> {
91
+ const server = Fastify({ logger: false });
92
+ await server.register(async (webhooksScope) => {
93
+ webhooksScope.addContentTypeParser("application/json", { parseAs: "buffer" }, (_req, body, done) => {
94
+ done(null, body);
95
+ });
96
+ webhooksScope.addHook("onRequest", async (request) => {
97
+ for (const level of ["info", "warn", "error"] as const) {
98
+ const original = request.log[level].bind(request.log);
99
+ request.log[level] = ((...args: unknown[]) => {
100
+ logCalls.push(args as LogCall);
101
+ return (original as (...a: unknown[]) => void)(...args);
102
+ }) as typeof request.log.info;
103
+ }
104
+ });
105
+ webhooksScope.post("/v1/webhooks/stripe", stripeWebhookHandler);
106
+ });
107
+ await server.ready();
108
+ return server;
109
+ }
110
+
111
+ const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
112
+ const HEADERS = { "content-type": "application/json", "stripe-signature": "t=1234,v1=abc" };
113
+
114
+ let server: FastifyInstance;
115
+
116
+ beforeEach(async () => {
117
+ jest.clearAllMocks();
118
+ logCalls.length = 0;
119
+ __resetIdempotencyStore();
120
+ jest.replaceProperty(configModule, "config", {
121
+ ...configModule.config,
122
+ STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
123
+ });
124
+ (prisma.flowCheckout.findUnique as jest.Mock).mockResolvedValue({ amountMinor: 24900 });
125
+ (prisma.flowCheckout.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
126
+ (prisma.user.findFirst as jest.Mock).mockResolvedValue(null);
127
+ (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
128
+ server = await buildTestServer();
129
+ });
130
+
131
+ afterEach(async () => {
132
+ await server.close();
133
+ jest.restoreAllMocks();
134
+ });
135
+
136
+ async function post() {
137
+ return server.inject({ method: "POST", url: "/v1/webhooks/stripe", payload: VALID_BODY, headers: HEADERS });
138
+ }
139
+
140
+ function stampCall() {
141
+ expect(prisma.flowCheckout.updateMany).toHaveBeenCalledTimes(1);
142
+ return (prisma.flowCheckout.updateMany as jest.Mock).mock.calls[0][0];
143
+ }
144
+
145
+ // ── AC-1 — completed stamps the row once, guarded, beside the legacy tasks ──
146
+
147
+ describe("AC-1 — completed stamps the row once, guarded, beside the legacy tasks", () => {
148
+ it("stamps completed with the guard, the session id and the customer; telemetry + billing still run", async () => {
149
+ mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.completed"));
150
+ const res = await post();
151
+ expect(res.statusCode).toBe(200);
152
+ expect(JSON.parse(res.body)).toEqual({ received: true });
153
+
154
+ const call = stampCall();
155
+ expect(call.where).toEqual({ id: FLOW_CHECKOUT_ID, status: "created" });
156
+ expect(call.data.status).toBe("completed");
157
+ expect(call.data.completedAt).toBeInstanceOf(Date);
158
+ expect(call.data.stripeSessionId).toBe(SESSION_ID);
159
+ expect(call.data.stripeCustomerId).toBe(CUSTOMER_ID);
160
+
161
+ // The legacy tasks, exactly as stripe.test.ts asserts them.
162
+ expect(mockTrack).toHaveBeenCalledTimes(1);
163
+ expect(mockTrack).toHaveBeenCalledWith("purchase-completed", {
164
+ amount: 24900,
165
+ currency: "usd",
166
+ productId: undefined,
167
+ eventType: "checkout.session.completed",
168
+ eventIdPrefix: "evt_test",
169
+ });
170
+ expect(prisma.user.findFirst).toHaveBeenCalledWith({
171
+ where: { billingProvider: "stripe", billingCustomerId: CUSTOMER_ID },
172
+ });
173
+ expect(prisma.user.findUnique).toHaveBeenCalledWith({ where: { email: EMAIL } });
174
+ });
175
+ });
176
+
177
+ // ── AC-2 — expired stamps expired ───────────────────────────────────────────
178
+
179
+ describe("AC-2 — expired stamps expired", () => {
180
+ it("stamps status expired under the same guard, with no completedAt", async () => {
181
+ mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.expired"));
182
+ const res = await post();
183
+ expect(res.statusCode).toBe(200);
184
+ const call = stampCall();
185
+ expect(call.where.status).toBe("created");
186
+ expect(call.where.id).toBe(FLOW_CHECKOUT_ID);
187
+ expect(call.data).toEqual({ status: "expired" });
188
+ expect(call.data).not.toHaveProperty("completedAt");
189
+ expect(prisma.flowCheckout.findUnique).not.toHaveBeenCalled();
190
+ expect(mockTrack).not.toHaveBeenCalled();
191
+ });
192
+ });
193
+
194
+ // ── AC-3 — the legacy paths are byte-unchanged ──────────────────────────────
195
+
196
+ describe("AC-3 — the legacy paths are byte-unchanged", () => {
197
+ it("an event without flowCheckoutId never touches prisma.flowCheckout", async () => {
198
+ mockVerifyWebhookSignature.mockReturnValue(
199
+ sessionEvent("checkout.session.completed", { metadata: { productId: "starter" } }),
200
+ );
201
+ const res = await post();
202
+ expect(res.statusCode).toBe(200);
203
+ expect(prisma.flowCheckout.findUnique).not.toHaveBeenCalled();
204
+ expect(prisma.flowCheckout.updateMany).not.toHaveBeenCalled();
205
+ expect(mockTrack).toHaveBeenCalledTimes(1);
206
+ });
207
+
208
+ it("an expired event without the key is a no-op 200 that logs the unhandled-event line", async () => {
209
+ mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.expired", { metadata: null }));
210
+ expect((await post()).statusCode).toBe(200);
211
+ expect(prisma.flowCheckout.updateMany).not.toHaveBeenCalled();
212
+ const unhandled = logCalls.find((c) => c[1] === "unhandled webhook event");
213
+ expect(unhandled?.[0]).toEqual({ eventType: "checkout.session.expired", eventIdPrefix: "evt_test" });
214
+ });
215
+
216
+ it("a completed session that is not paid logs `unpaid` and does NOT stamp — the row stays created", async () => {
217
+ mockVerifyWebhookSignature.mockReturnValue(
218
+ sessionEvent("checkout.session.completed", { payment_status: "unpaid" }),
219
+ );
220
+ expect((await post()).statusCode).toBe(200);
221
+ expect(prisma.flowCheckout.findUnique).not.toHaveBeenCalled();
222
+ expect(prisma.flowCheckout.updateMany).not.toHaveBeenCalled();
223
+ const unpaid = logCalls.find((c) => (c[0] as { outcome?: string })?.outcome === "unpaid");
224
+ expect(unpaid?.[0]).toEqual({
225
+ eventIdPrefix: "evt_test",
226
+ flowCheckoutIdPrefix: FLOW_CHECKOUT_ID.substring(0, 8),
227
+ outcome: "unpaid",
228
+ });
229
+ // The legacy tasks still ran for the event.
230
+ expect(mockTrack).toHaveBeenCalledTimes(1);
231
+ });
232
+ });
233
+
234
+ // ── AC-6 — a zero-due (no_payment_required) session stamps completed ───────
235
+
236
+ describe("AC-6 — no_payment_required stamps completed exactly as paid (#4862)", () => {
237
+ it("stamps completed with the guard, the session id and the customer; telemetry + billing still run", async () => {
238
+ mockVerifyWebhookSignature.mockReturnValue(
239
+ sessionEvent("checkout.session.completed", { payment_status: "no_payment_required" }),
240
+ );
241
+ const res = await post();
242
+ expect(res.statusCode).toBe(200);
243
+ expect(JSON.parse(res.body)).toEqual({ received: true });
244
+
245
+ const call = stampCall();
246
+ expect(call.where).toEqual({ id: FLOW_CHECKOUT_ID, status: "created" });
247
+ expect(call.data.status).toBe("completed");
248
+ expect(call.data.completedAt).toBeInstanceOf(Date);
249
+ expect(call.data.stripeSessionId).toBe(SESSION_ID);
250
+ expect(call.data.stripeCustomerId).toBe(CUSTOMER_ID);
251
+
252
+ expect(mockTrack).toHaveBeenCalledTimes(1);
253
+ const unpaid = logCalls.find((c) => (c[0] as { outcome?: string })?.outcome === "unpaid");
254
+ expect(unpaid).toBeUndefined();
255
+ });
256
+ });
257
+
258
+ // ── AC-4 — never a retry storm ──────────────────────────────────────────────
259
+
260
+ describe("AC-4 — never a retry storm", () => {
261
+ it("count 0 logs stale_or_unknown and still 200s", async () => {
262
+ (prisma.flowCheckout.updateMany as jest.Mock).mockResolvedValue({ count: 0 });
263
+ mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.completed"));
264
+ expect((await post()).statusCode).toBe(200);
265
+ const stale = logCalls.find((c) => (c[0] as { outcome?: string })?.outcome === "stale_or_unknown");
266
+ expect(stale).toBeDefined();
267
+ });
268
+
269
+ it("an updateMany rejection logs an error and still 200s", async () => {
270
+ (prisma.flowCheckout.updateMany as jest.Mock).mockRejectedValue(new Error("db down"));
271
+ mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.completed"));
272
+ expect((await post()).statusCode).toBe(200);
273
+ const failed = logCalls.find((c) => (c[0] as { outcome?: string })?.outcome === "stamp_failed");
274
+ expect(failed).toBeDefined();
275
+ });
276
+
277
+ it("a charged amount that differs from the quote logs both integers and STILL stamps completed", async () => {
278
+ mockVerifyWebhookSignature.mockReturnValue(sessionEvent("checkout.session.completed", { amount_total: 25000 }));
279
+ expect((await post()).statusCode).toBe(200);
280
+ const mismatch = logCalls.find((c) => (c[0] as { outcome?: string })?.outcome === "amount_mismatch");
281
+ expect(mismatch?.[0]).toEqual({
282
+ eventIdPrefix: "evt_test",
283
+ flowCheckoutIdPrefix: FLOW_CHECKOUT_ID.substring(0, 8),
284
+ outcome: "amount_mismatch",
285
+ expected: 24900,
286
+ received: 25000,
287
+ });
288
+ expect(stampCall().data.status).toBe("completed");
289
+ });
290
+ });
291
+
292
+ // ── AC-5 — PII boundary ─────────────────────────────────────────────────────
293
+
294
+ describe("AC-5 — PII boundary", () => {
295
+ it.each([
296
+ ["the AC-1 event", sessionEvent("checkout.session.completed"), null],
297
+ ["the AC-4 mismatch event", sessionEvent("checkout.session.completed", { amount_total: 25000 }), null],
298
+ [
299
+ "the stamp_failed branch",
300
+ sessionEvent("checkout.session.completed"),
301
+ new Error(`connection refused for ${EMAIL} at ${CUSTOMER_ID}`),
302
+ ],
303
+ ])("every log line for %s carries no email, customer_details, permalink, or a full cus_/cs_ id", async (_name, event, rejection) => {
304
+ if (rejection) (prisma.flowCheckout.updateMany as jest.Mock).mockRejectedValue(rejection);
305
+ mockVerifyWebhookSignature.mockReturnValue(event);
306
+ expect((await post()).statusCode).toBe(200);
307
+ const ALLOWED = new Set(["eventIdPrefix", "flowCheckoutIdPrefix", "outcome", "expected", "received", "errName"]);
308
+ const stampLines = logCalls.filter((c) => typeof c[0] === "object" && c[0] !== null && "flowCheckoutIdPrefix" in c[0]);
309
+ expect(stampLines.length).toBeGreaterThan(0);
310
+ for (const line of stampLines) {
311
+ for (const key of Object.keys(line[0] as object)) expect(ALLOWED.has(key)).toBe(true);
312
+ }
313
+ if (rejection) {
314
+ const failed = stampLines.find((c) => (c[0] as { outcome?: string }).outcome === "stamp_failed");
315
+ expect(failed?.[0]).toEqual({
316
+ eventIdPrefix: "evt_test",
317
+ flowCheckoutIdPrefix: FLOW_CHECKOUT_ID.substring(0, 8),
318
+ outcome: "stamp_failed",
319
+ errName: "Error",
320
+ });
321
+ }
322
+ for (const line of logCalls) {
323
+ const text = JSON.stringify(line);
324
+ expect(text).not.toContain(EMAIL);
325
+ expect(text).not.toContain("customer_details");
326
+ expect(text).not.toContain(PERMALINK);
327
+ for (const token of text.match(/\b(?:cus|cs)_[A-Za-z0-9_]+/g) ?? []) expect(token.length).toBeLessThanOrEqual(8);
328
+ }
329
+ });
330
+ });
@@ -0,0 +1,262 @@
1
+ /**
2
+ * Stripe webhook idempotency — replay protection at the AILK layer.
3
+ *
4
+ * Stripe guarantees at-least-once delivery; an `event.id` can arrive multiple
5
+ * times (network retries, dashboard manual replay). The handler MUST be
6
+ * idempotent: a second arrival with the same `event.id` returns 200 without
7
+ * re-firing telemetry or any side effect.
8
+ *
9
+ * Implementation: module-scoped store with TTL — see
10
+ * `apps/api/src/lib/webhook-idempotency.ts` for the deliberate single-replica
11
+ * trade-off vs. a durable table.
12
+ */
13
+ import type { FastifyInstance } from "fastify";
14
+ import Fastify from "fastify";
15
+
16
+ // ── Mocks ────────────────────────────────────────────────────────────────────
17
+
18
+ const mockConfig: { STRIPE_WEBHOOK_SECRET: string | undefined } = {
19
+ STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
20
+ };
21
+ // eslint-disable-next-line no-restricted-syntax -- mirrors stripe.test.ts mock pattern
22
+ jest.mock("../../../config/index.js", () => ({
23
+ get config() {
24
+ return mockConfig;
25
+ },
26
+ }));
27
+
28
+ const mockTrack = jest.fn().mockResolvedValue(undefined);
29
+ // Commerce claim (D-64, #5796): the receiver is a base-tree primitive gated on
30
+ // the JWT `commerce` claim, so every case in this file is a COMMERCE-CLAIMED
31
+ // deployment — which is what each one was already asserting before the gate
32
+ // existed. The unclaimed matrix lives in
33
+ // `src/__tests__/commerce-claim-registration.test.ts`.
34
+ jest.mock("@working-theory/license", () => ({
35
+ checkLicense: jest.fn().mockResolvedValue({
36
+ tier: "pro",
37
+ plan: "pro-monthly",
38
+ features: ["commerce"],
39
+ expiresAt: null,
40
+ revoked: false,
41
+ }),
42
+ }));
43
+
44
+ jest.mock("@working-theory/analytics/server", () => ({
45
+ track: (...args: unknown[]) => mockTrack(...args),
46
+ }));
47
+
48
+ const mockVerifyWebhookSignature = jest.fn();
49
+ class MockStripeWebhookSignatureError extends Error {
50
+ constructor(message: string) {
51
+ super(message);
52
+ this.name = "StripeWebhookSignatureError";
53
+ }
54
+ }
55
+ // eslint-disable-next-line no-restricted-syntax -- mirrors stripe.test.ts mock pattern
56
+ jest.mock("../../../lib/stripe.js", () => ({
57
+ verifyWebhookSignature: (...args: unknown[]) =>
58
+ mockVerifyWebhookSignature(...args),
59
+ StripeWebhookSignatureError: MockStripeWebhookSignatureError,
60
+ }));
61
+
62
+ import { stripeWebhookHandler } from "../stripe.js";
63
+ import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
64
+
65
+ // ── Helpers ──────────────────────────────────────────────────────────────────
66
+
67
+ function buildFakeEvent(id: string, overrides: Record<string, unknown> = {}) {
68
+ return {
69
+ id,
70
+ type: "checkout.session.completed",
71
+ data: {
72
+ object: {
73
+ amount_total: 4999,
74
+ currency: "usd",
75
+ metadata: { productId: "starter" },
76
+ },
77
+ },
78
+ ...overrides,
79
+ };
80
+ }
81
+
82
+ async function buildTestServer(): Promise<FastifyInstance> {
83
+ const server = Fastify({ logger: false });
84
+
85
+ await server.register(async (webhooksScope) => {
86
+ webhooksScope.addContentTypeParser(
87
+ "application/json",
88
+ { parseAs: "buffer" },
89
+ (_req, body, done) => {
90
+ done(null, body);
91
+ },
92
+ );
93
+ webhooksScope.post("/v1/webhooks/stripe", stripeWebhookHandler);
94
+ });
95
+
96
+ await server.ready();
97
+ return server;
98
+ }
99
+
100
+ const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
101
+ const VALID_SIGNATURE = "t=1234,v1=abc";
102
+
103
+ // ── Tests ────────────────────────────────────────────────────────────────────
104
+
105
+ describe("POST /api/webhooks/stripe — idempotency", () => {
106
+ let server: FastifyInstance;
107
+
108
+ beforeEach(async () => {
109
+ jest.clearAllMocks();
110
+ __resetIdempotencyStore();
111
+ mockConfig.STRIPE_WEBHOOK_SECRET = "whsec_test_secret";
112
+ server = await buildTestServer();
113
+ });
114
+
115
+ afterEach(async () => {
116
+ await server.close();
117
+ });
118
+
119
+ it("processes a first-time event normally (200 + track called)", async () => {
120
+ const event = buildFakeEvent("evt_first_time_aaaa");
121
+ mockVerifyWebhookSignature.mockReturnValue(event);
122
+
123
+ const response = await server.inject({
124
+ method: "POST",
125
+ url: "/v1/webhooks/stripe",
126
+ payload: VALID_BODY,
127
+ headers: {
128
+ "content-type": "application/json",
129
+ "stripe-signature": VALID_SIGNATURE,
130
+ },
131
+ });
132
+
133
+ expect(response.statusCode).toBe(200);
134
+ expect(JSON.parse(response.body)).toEqual({ received: true });
135
+ expect(mockTrack).toHaveBeenCalledTimes(1);
136
+ });
137
+
138
+ it("returns 200 on replay of same event.id without re-firing telemetry", async () => {
139
+ const event = buildFakeEvent("evt_replay_same_id_bbbb");
140
+ mockVerifyWebhookSignature.mockReturnValue(event);
141
+
142
+ // First delivery — processed normally
143
+ const first = await server.inject({
144
+ method: "POST",
145
+ url: "/v1/webhooks/stripe",
146
+ payload: VALID_BODY,
147
+ headers: {
148
+ "content-type": "application/json",
149
+ "stripe-signature": VALID_SIGNATURE,
150
+ },
151
+ });
152
+
153
+ expect(first.statusCode).toBe(200);
154
+ expect(mockTrack).toHaveBeenCalledTimes(1);
155
+
156
+ // Second delivery — same event.id, should be treated as duplicate
157
+ const second = await server.inject({
158
+ method: "POST",
159
+ url: "/v1/webhooks/stripe",
160
+ payload: VALID_BODY,
161
+ headers: {
162
+ "content-type": "application/json",
163
+ "stripe-signature": VALID_SIGNATURE,
164
+ },
165
+ });
166
+
167
+ expect(second.statusCode).toBe(200);
168
+ expect(JSON.parse(second.body)).toEqual({ received: true });
169
+ // Telemetry must NOT have fired again
170
+ expect(mockTrack).toHaveBeenCalledTimes(1);
171
+ });
172
+
173
+ it("processes distinct event.ids independently", async () => {
174
+ const eventA = buildFakeEvent("evt_distinct_aaaa");
175
+ const eventB = buildFakeEvent("evt_distinct_bbbb");
176
+
177
+ mockVerifyWebhookSignature.mockReturnValueOnce(eventA);
178
+ await server.inject({
179
+ method: "POST",
180
+ url: "/v1/webhooks/stripe",
181
+ payload: VALID_BODY,
182
+ headers: {
183
+ "content-type": "application/json",
184
+ "stripe-signature": VALID_SIGNATURE,
185
+ },
186
+ });
187
+
188
+ mockVerifyWebhookSignature.mockReturnValueOnce(eventB);
189
+ await server.inject({
190
+ method: "POST",
191
+ url: "/v1/webhooks/stripe",
192
+ payload: VALID_BODY,
193
+ headers: {
194
+ "content-type": "application/json",
195
+ "stripe-signature": VALID_SIGNATURE,
196
+ },
197
+ });
198
+
199
+ expect(mockTrack).toHaveBeenCalledTimes(2);
200
+ });
201
+
202
+ it("logs duplicate detection at info level on replay", async () => {
203
+ const event = buildFakeEvent("evt_logs_duplicate_cccc");
204
+ mockVerifyWebhookSignature.mockReturnValue(event);
205
+
206
+ const logLines: Array<Record<string, unknown>> = [];
207
+ const logCapture = Fastify({
208
+ logger: {
209
+ level: "info",
210
+ stream: {
211
+ write(msg: string) {
212
+ logLines.push(JSON.parse(msg) as Record<string, unknown>);
213
+ },
214
+ },
215
+ },
216
+ });
217
+
218
+ await logCapture.register(async (scope) => {
219
+ scope.addContentTypeParser(
220
+ "application/json",
221
+ { parseAs: "buffer" },
222
+ (_req, body, done) => {
223
+ done(null, body);
224
+ },
225
+ );
226
+ scope.post("/v1/webhooks/stripe", stripeWebhookHandler);
227
+ });
228
+ await logCapture.ready();
229
+
230
+ try {
231
+ // First delivery
232
+ await logCapture.inject({
233
+ method: "POST",
234
+ url: "/v1/webhooks/stripe",
235
+ payload: VALID_BODY,
236
+ headers: {
237
+ "content-type": "application/json",
238
+ "stripe-signature": VALID_SIGNATURE,
239
+ },
240
+ });
241
+ // Replay
242
+ logLines.length = 0;
243
+ await logCapture.inject({
244
+ method: "POST",
245
+ url: "/v1/webhooks/stripe",
246
+ payload: VALID_BODY,
247
+ headers: {
248
+ "content-type": "application/json",
249
+ "stripe-signature": VALID_SIGNATURE,
250
+ },
251
+ });
252
+
253
+ const matched = logLines.some((line) => {
254
+ const msg = String(line["msg"] ?? "");
255
+ return msg.includes("duplicate") || msg.includes("idempotent");
256
+ });
257
+ expect(matched).toBe(true);
258
+ } finally {
259
+ await logCapture.close();
260
+ }
261
+ });
262
+ });