create-ailk 0.7.0 → 0.8.0

package/templates/apps/mcp/__tests__/parity.test.ts

@@ -103,7 +103,6 @@ const MCP_ONLY_TOOLS = new Set([
   "ailkGetPricing", // get_pricing — pure read, no action equivalent (I4)
   "ailkGetFaq", // get_faq — pure read, no action equivalent (I4)
   "ailkAudit", // audit — AEO scoring tool, no web action equivalent (I5; ADR 0013)
-  "ailkSubscribeNewsletter", // subscribe_newsletter — anonymous write via MCP; no Server Action (B7)
   "ailkRequestCallback", // request_callback — anonymous write via MCP; no Server Action (B7)
   "ailkCreateProject", // create_project — agent-only project creator; no Server Action equivalent (#299)
   "ailkGetFlow", // get_flow — agent-callable flow-engine read; no web Server Action (#3956 D7)
@@ -228,6 +227,8 @@ describe("MCP ↔ Server-Action parity (filesystem)", () => {
     // ailkSubmitFlowStep): twenty tools + three paired Server Actions.
     // - ailkPurchase: paired with purchaseAction (apps/web/app/dev/purchase/).
     // - ailkCaptureLead: paired with captureLeadAction (apps/web/app/contact/).
+    // - ailkSubscribeNewsletter: paired with subscribeNewsletterAction
+    //   (apps/web/app/[locale]/newsletter/newsletter.actions.ts, #6730 D9).
     // - ailkSubmitFlowStep: paired with submitFlowStepAction
     //   (apps/web/app/[locale]/flows/[slug]/flow.actions.ts, #3957).
     // - startCheckoutAction, saveRecommendationAction: WEB-ONLY (#4842 D7,
@@ -241,8 +242,8 @@ describe("MCP ↔ Server-Action parity (filesystem)", () => {
     //   ailkGetLocations, ailkGetOfferings, ailkGetPricing, ailkGetFaq:
     //   MCP-only (pure read; I4; in MCP_ONLY_TOOLS allow-list).
     // - ailkAudit: MCP-only (AEO scoring; I5; in MCP_ONLY_TOOLS allow-list).
-    // - ailkSubscribeNewsletter, ailkRequestCallback:
-    //   MCP-only anonymous-write tools (B7; in MCP_ONLY_TOOLS allow-list).
+    // - ailkRequestCallback: MCP-only anonymous-write tool (B7; in
+    //   MCP_ONLY_TOOLS allow-list).
     // - ailkCreateProject: MCP-only agent project creator (#299; in MCP_ONLY_TOOLS).
     // - ailkCreatePage, ailkUpdatePage, ailkDeletePage: RETIRED by #5853
     //   (D7). Their HTTP twins — the untenanted /v1/content writes — were
@@ -264,7 +265,7 @@ describe("MCP ↔ Server-Action parity (filesystem)", () => {
     // - ailkGetEventMeta: MCP-only meta-only scheduling read, twin of
     //   GET /v1/schedule/event-meta (#4633) — same posture as the other
     //   scheduling tools.
-    expect(actions.size).toBe(5);
+    expect(actions.size).toBe(6);
     expect(tools.size).toBe(20);
     expect(r.missingTools).toEqual([]);
     expect(r.orphanTools).toEqual([]);

package/templates/apps/mcp/src/tools/create_project.ts

@@ -16,6 +16,12 @@
  * correctly in production and in integration tests.
  *
  * Input:  { targetDir, projectName, preset? }
+ *   The tool builds the Free organization-product starter (`--shape
+ *   organization-product`, #6754 D9); `preset` stays reserved. Always builds
+ *   the Free module set (`--modules marketing`, #6759 D6, SEC-7): a licence
+ *   key sitting in the MCP server's own environment never widens what an
+ *   anonymous caller receives — the explicit keep list takes precedence over
+ *   any key-derived level probe before the child process reads its env.
  *   targetDir   — absolute or relative path to scaffold into; must not exist
  *                 or must be empty (enforced by create-ailk ValidationError)
  *   projectName — project name used in README and package.json
@@ -94,12 +100,21 @@ export async function ailkCreateProject(
   const targetAbs = resolve(input.targetDir);
 
   // Spawn the CLI synchronously — no network, no async I/O needed.
-  // Hard-coded node invocation; only targetDir flows through user input.
-  const result = spawnSync("node", [bin, targetAbs], {
-    stdio: ["ignore", "pipe", "pipe"],
-    shell: false,
-    encoding: "utf8",
-  });
+  // Hard-coded node invocation; only targetDir flows through user input. The
+  // CLI refuses a run naming no shape and no template, so the tool names one.
+  // `--modules marketing` is pinned explicitly (#6759 D6, SEC-7): an explicit
+  // keep list takes the keep branch and resolves before the child ever reads
+  // AILK_LICENSE_KEY, so a licence key in the server's own environment can
+  // never turn this anonymous call into the keyed level probe.
+  const result = spawnSync(
+    "node",
+    [bin, targetAbs, "--shape", "organization-product", "--modules", "marketing"],
+    {
+      stdio: ["ignore", "pipe", "pipe"],
+      shell: false,
+      encoding: "utf8",
+    },
+  );
 
   if (result.status !== 0) {
     // Extract the error message from stderr (CLI writes "[create-ailk] <msg>").

package/templates/apps/web/app/[locale]/contact/ConversationalIntakeWrapper.tsx

@@ -8,8 +8,8 @@
  * conversation logic, only:
  *
  *   1. Submission — `onComplete` hands the finished answers to the SAME
- *      `captureLeadAction` (`./contact.actions.ts`) the plain `<ContactForm/>`
- *      already uses, built as a `FormData` (imperatively, not a real
+ *      `captureLeadAction` (`./contact.actions.ts`) the shared
+ *      `LeadCaptureForm` on `/contact` already uses, built as a `FormData` (imperatively, not a real
  *      `<form>` submit — React 19 Server Actions are plain async functions).
  *      That action posts through the EXISTING `POST /v1/leads/submit` route
  *      (`apps/api/src/routes/leads`, consumed via `@working-theory/api-client`,
@@ -21,7 +21,8 @@
  *      second web surface, not a new one. `contact.actions.ts`'s own
  *      doc-comment covers the additive `source` FormData field this file
  *      sets to distinguish intake-originated leads.
- *   2. Skip fallback — `onSkip` swaps to the EXISTING `<ContactForm/>`,
+ *   2. Skip fallback — `onSkip` swaps to the shared `LeadCaptureForm` block
+ *      (#6730 — the one contact form), bound to the same action,
  *      carrying over whatever answers were already captured as its
  *      `initialValues` prefill. A failed auto-submit on `onComplete` falls
  *      back the same way, so a lead is never silently lost.
@@ -43,14 +44,16 @@ import {
   ConversationalIntake,
   type ConversationalIntakeProps,
   InlineMessage,
+  LeadCaptureForm,
+  localeHref,
   THINKING_DELAY_MAX_MS,
   THINKING_DELAY_MIN_MS,
 } from "@working-theory/ui";
 import { useLocale, useTranslations } from "next-intl";
 import { useCallback, useMemo, useRef, useState } from "react";
 
+import { contactFormText } from "./contact-form-text";
 import { captureLeadAction } from "./contact.actions";
-import { ContactForm, type ContactFormInitialValues } from "./ContactForm";
 import { recordIntakeTurn } from "./intake-analytics";
 import { buildContactIntakeScript } from "./intake-script";
 
@@ -120,7 +123,7 @@ export function ConversationalIntakeWrapper({
   );
 
   const [surface, setSurface] = useState<Surface>("intake");
-  const [initialValues, setInitialValues] = useState<ContactFormInitialValues>(
+  const [initialValues, setInitialValues] = useState<Record<string, string>>(
     {},
   );
   const [submitError, setSubmitError] = useState<string | undefined>(
@@ -193,7 +196,12 @@ export function ConversationalIntakeWrapper({
             {submitError}
           </InlineMessage>
         ) : null}
-        <ContactForm initialValues={initialValues} />
+        <LeadCaptureForm
+          action={captureLeadAction}
+          text={contactFormText(t)}
+          termsHref={localeHref(locale, "/terms")}
+          initialValues={initialValues}
+        />
       </Container>
     );
   }

package/templates/apps/web/app/[locale]/contact/__tests__/ConversationalIntakeWrapper.test.tsx

@@ -6,8 +6,8 @@
  *   the EXISTING lead-capture endpoint. Only the outermost network
  *   boundary is mocked (`@working-theory/api-client`'s `leads.submit`) —
  *   the REAL `ConversationalIntake` block (#4543) and its engine (#4532),
- *   the REAL `captureLeadAction` (the SAME action `<ContactForm/>` already
- *   uses), and the REAL `submitLeadInputSchema` validation all run, proving
+ *   the REAL `captureLeadAction` (the SAME action the shared
+ *   `LeadCaptureForm` on `/contact` uses), and the REAL `submitLeadInputSchema` validation all run, proving
  *   the whole chain end to end. No file under apps/api is imported, mocked,
  *   or touched by this test or by the wiring it exercises.
  * AC2 — Skip renders the existing form, carrying over answers already
@@ -36,13 +36,14 @@ jest.mock("@working-theory/analytics/server", () => ({
 }));
 
 // ConversationalIntakeWrapper's own responsibility under test here is the
-// submission/skip/analytics wiring around the block — not ContactForm's own
-// rendering, which apps/web's existing tests already document as crashing
-// in jsdom (useFormState/useFormStatus; see page-renderer-migration.test.tsx).
-// Narrow internal-module mock, same precedent as that file's ContactForm stub.
-// eslint-disable-next-line no-restricted-syntax -- test-seam mock required; ContactForm uses useFormState/useFormStatus which crash in jsdom (see page-renderer-migration.test.tsx); narrowest possible scope
-jest.mock("../ContactForm", () => ({
-  ContactForm: (props: { initialValues?: Record<string, string> }) =>
+// submission/skip/analytics wiring around the block — not the shared
+// LeadCaptureForm's own rendering, which its block suite covers
+// (packages/ui/src/blocks/__tests__/LeadCaptureForm.test.tsx). The real
+// `@working-theory/ui` runs (the ConversationalIntake block included); only
+// the form block is stubbed, so the carried-over `initialValues` can be read.
+jest.mock("@working-theory/ui", () => ({
+  ...jest.requireActual("@working-theory/ui"),
+  LeadCaptureForm: (props: { initialValues?: Record<string, string> }) =>
     require("react").createElement("div", {
       "data-testid": "contact-form-stub",
       "data-initial-values": JSON.stringify(props.initialValues ?? {}),

package/templates/apps/web/app/[locale]/contact/__tests__/contact-form-text.test.ts

@@ -0,0 +1,32 @@
+/**
+ * contactFormText (#6730 D8) — the `contact` namespace mapped onto the shared
+ * form block's copy, with `unavailableBody`'s `{email}` placeholder kept for
+ * the block to fill.
+ */
+import messages from "../../../../messages/en.json";
+import { contactFormText } from "../contact-form-text";
+
+/** A translator over the English catalog that interpolates `{name}` values, as ICU does. */
+function translator(key: string, values?: Record<string, string>): string {
+  const template = (messages.contact as Record<string, unknown>)[key];
+  if (typeof template !== "string") throw new Error(`missing contact.${key}`);
+  return template.replace(/\{(\w+)\}/g, (m, name: string) => values?.[name] ?? m);
+}
+
+describe("contactFormText", () => {
+  it("maps every block string from the English catalog, keeping {email} for the block", () => {
+    expect(contactFormText(translator)).toEqual({
+      nameLabel: "Name",
+      emailLabel: "Email",
+      messageLabel: "Message",
+      submit: "Send message",
+      sending: "Sending…",
+      success: messages.contact.successMessage,
+      genericError: messages.contact.genericError,
+      consentStatement: messages.contact.consentStatement,
+      unavailableHeading: messages.contact.unavailableHeading,
+      unavailableBody: "Email us at {email} and we'll reply.",
+      unavailableNoEmail: messages.contact.unavailableNoEmail,
+    });
+  });
+});

package/templates/apps/web/app/[locale]/contact/__tests__/contact.actions.test.ts

@@ -179,3 +179,132 @@ describe("captureLeadAction — API error", () => {
     consoleErrorSpy.mockRestore();
   });
 });
+
+// ─── #6730 D8 — honest outcomes and declared extra fields ────────────────────
+
+describe("captureLeadAction — outcome mapping (#6730)", () => {
+  it("503 lead_capture_not_configured → unavailable", async () => {
+    mockSubmit.mockResolvedValueOnce({
+      ok: false,
+      status: 503,
+      body: { error: "lead_capture_not_configured", message: "Lead capture is not configured." },
+    });
+
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+
+    expect(result).toEqual({ kind: "unavailable" });
+  });
+
+  it("503 delivery_failed → the generic error, never success", async () => {
+    mockSubmit.mockResolvedValueOnce({
+      ok: false,
+      status: 503,
+      body: { error: "delivery_failed", message: "The message could not be delivered." },
+    });
+
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+
+    expect(result).toMatchObject({ kind: "error" });
+    expect(result).not.toMatchObject({ kind: "success" });
+  });
+
+  it.each([400, 429, 500, 503])("a non-2xx (%s) is never success", async (status) => {
+    mockSubmit.mockResolvedValueOnce({ ok: false, status, body: { error: "x" } });
+
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+
+    expect(result?.kind).toBe("error");
+  });
+
+  it("201 → success", async () => {
+    mockSubmit.mockResolvedValueOnce({
+      ok: true,
+      body: { id: "email-1-abcdef12", persisted: "email" },
+    });
+
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+
+    expect(result).toEqual({ kind: "success" });
+  });
+});
+
+describe("captureLeadAction — declared extra fields (#6730 D8a)", () => {
+  it("carries an extra string field (e.g. a select) into payload", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: { id: "lead_1", persisted: "db" } });
+
+    await captureLeadAction(INITIAL_STATE, makeFormData({ ...VALID_FIELDS, plan: "pro" }));
+
+    const body = mockSubmit.mock.calls[0][0] as { payload: Record<string, unknown> };
+    expect(body.payload.plan).toBe("pro");
+  });
+
+  it("never copies reserved or Next-internal fields into payload", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: { id: "lead_1", persisted: "db" } });
+
+    await captureLeadAction(
+      INITIAL_STATE,
+      makeFormData({
+        ...VALID_FIELDS,
+        consent: "true",
+        ailk_hp: "",
+        source: "conversational-intake",
+        $ACTION_ID_abc: "",
+      }),
+    );
+
+    const body = mockSubmit.mock.calls[0][0] as {
+      source: string;
+      payload: Record<string, unknown>;
+    };
+    expect(Object.keys(body.payload).sort()).toEqual(["message", "name"]);
+    expect(body.source).toBe("conversational-intake");
+  });
+
+  it("more than 20 extra keys → a form error, no API call", async () => {
+    const extras = Object.fromEntries(
+      Array.from({ length: 21 }, (_, i) => [`extra${i}`, "x"]),
+    );
+
+    const result = await captureLeadAction(
+      INITIAL_STATE,
+      makeFormData({ ...VALID_FIELDS, ...extras }),
+    );
+
+    expect(result).toMatchObject({ kind: "error" });
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it("an extra value over 2000 characters → a form error, no API call", async () => {
+    const result = await captureLeadAction(
+      INITIAL_STATE,
+      makeFormData({ ...VALID_FIELDS, notes: "x".repeat(2001) }),
+    );
+
+    expect(result).toMatchObject({ kind: "error" });
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+});
+
+describe("captureLeadAction — honeypot (#6730)", () => {
+  it("a filled honeypot → success, and nothing is sent", async () => {
+    const result = await captureLeadAction(
+      INITIAL_STATE,
+      makeFormData({ ...VALID_FIELDS, ailk_hp: "https://spam.example" }),
+    );
+
+    expect(result).toEqual({ kind: "success" });
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it("a declared `website` field is an ordinary field, carried into payload", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: { id: "lead_1", persisted: "db" } });
+
+    await captureLeadAction(
+      INITIAL_STATE,
+      makeFormData({ ...VALID_FIELDS, website: "https://acme.example" }),
+    );
+
+    const body = mockSubmit.mock.calls[0][0] as { payload: Record<string, unknown> };
+    expect(body.payload.website).toBe("https://acme.example");
+  });
+});