create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/tests/core/projects.test.ts

@@ -0,0 +1,292 @@
+// Copyright (C) 2026 Tony Aly
+// SPDX-License-Identifier: Apache-2.0
+// Project records (C6.15, MASTER.md §4.7).
+//
+// The claims worth proving:
+//
+//   1. **A project links rather than copies.** The invoice on a project is the
+//      invoice in the ledger, so there is never a second answer to what the
+//      customer owes.
+//   2. **It is the same entity C8.01 will publish**, which is why the slug is
+//      unique and stable and why `clientDisplayName` exists.
+//   3. **Before/after is a pairing**, not two uploads, enforced in both
+//      directions so neither half can exist without the other's key.
+//   4. **Erasure keeps the work and forgets the person** — a project is the
+//      business's own record of what it did.
+import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import { eq } from "drizzle-orm";
+import { users } from "@/core/auth/schema";
+import { assets } from "@/core/media/schema";
+import { contacts } from "@/core/contacts/schema";
+import { projectFiles, projectLinks, projects } from "@/modules/projects/schema";
+import { db } from "@/core/db";
+import { restoreTask } from "@/core/tasks/service";
+import { ready } from "@/core/runtime";
+import { getService } from "@/core/service";
+import {
+  addTask,
+  attachFile,
+  createProject,
+  getProject,
+  linkToProject,
+  listProjects,
+  projectsForSubject,
+  removeTask,
+  setOutcome,
+  setTaskStatus,
+  unlinkFromProject,
+  updateProject,
+} from "@/modules/projects/service";
+import { closeDb, failure, hasDatabase, OWNER, truncateSpine } from "../helpers/spine";
+
+describe.runIf(hasDatabase)("projects", { timeout: 90_000 }, () => {
+  beforeEach(async () => {
+    await ready();
+    await truncateSpine();
+    await db()
+      .insert(users)
+      .values({ id: OWNER.userId, email: "owner@example.test", role: "owner" })
+      .onConflictDoNothing();
+  }, 60_000);
+
+  afterAll(async () => {
+    await truncateSpine();
+    await closeDb();
+  });
+
+  async function contactId(): Promise<string> {
+    const resolved = (await getService("contacts.resolve").call(
+      { email: "rae@example.test", name: "Rae Lane", source: "test" },
+      { kind: "system" },
+    )) as { contact: { id: string } };
+    return resolved.contact.id;
+  }
+
+  async function project(overrides: Record<string, unknown> = {}) {
+    return createProject.call(
+      { title: "Henderson kitchen", contactId: await contactId(), ...overrides },
+      OWNER,
+    );
+  }
+
+  async function asset(): Promise<string> {
+    const [created] = await db()
+      .insert(assets)
+      .values({
+        kind: "image",
+        storageKey: `test/${crypto.randomUUID()}.jpg`,
+        filename: "before.jpg",
+        mime: "image/jpeg",
+        legacyBytes: 1_024,
+        bytes: 1_024,
+      })
+      .returning({ id: assets.id });
+    return created!.id;
+  }
+
+  it("names itself for the web without anybody inventing a slug", async () => {
+    const created = await project();
+    expect(created.slug).toBe("henderson-kitchen");
+    expect(created.status).toBe("enquiry");
+  });
+
+  // The slug is the address C8.01 will publish at, so a collision is a naming
+  // decision rather than an internal error.
+  it("refuses two projects at the same web address", async () => {
+    await project();
+    const clash = await failure(project());
+    expect(clash.message).toContain("web address");
+  });
+
+  it("records work with no client at all", async () => {
+    const internal = await createProject.call({ title: "Rebuild our own site" }, OWNER);
+    expect(internal.contactId).toBeNull();
+  });
+
+  // The whole point of the record: one place where the quote, the agreement,
+  // the bookings and the invoice are the same job.
+  it("gathers a job's paperwork without copying any of it", async () => {
+    const created = await project();
+    const quoteId = "00000000-0000-4000-8000-000000000001";
+    const invoiceId = "00000000-0000-4000-8000-000000000002";
+    await linkToProject.call(
+      { projectId: created.id, kind: "quote", targetId: quoteId, label: "Q-0001" },
+      OWNER,
+    );
+    await linkToProject.call(
+      { projectId: created.id, kind: "invoice", targetId: invoiceId },
+      OWNER,
+    );
+
+    const full = await getProject.call({ id: created.id }, OWNER);
+    expect(full?.links).toHaveLength(2);
+    // Pointers, not copies: nothing here restates a total.
+    expect(full?.links.map((link) => link.targetId)).toContain(invoiceId);
+  });
+
+  it("treats attaching the same thing twice as one attachment", async () => {
+    const created = await project();
+    const quoteId = "00000000-0000-4000-8000-000000000001";
+    await linkToProject.call({ projectId: created.id, kind: "quote", targetId: quoteId }, OWNER);
+    await linkToProject.call(
+      { projectId: created.id, kind: "quote", targetId: quoteId, label: "Q-0001" },
+      OWNER,
+    );
+    const rows = await db().select().from(projectLinks);
+    expect(rows).toHaveLength(1);
+    // The label is refreshed rather than duplicated.
+    expect(rows[0]!.label).toBe("Q-0001");
+  });
+
+  it("takes something off a project without deleting it", async () => {
+    const created = await project();
+    const link = await linkToProject.call(
+      { projectId: created.id, kind: "booking", targetId: "00000000-0000-4000-8000-000000000003" },
+      OWNER,
+    );
+    await unlinkFromProject.call({ id: link.id }, OWNER);
+    const full = await getProject.call({ id: created.id }, OWNER);
+    expect(full?.links).toHaveLength(0);
+    // The project itself is untouched — only the attachment went.
+    expect(full?.title).toBe("Henderson kitchen");
+  });
+
+  // So an invoice screen can say "part of the Henderson kitchen" without
+  // invoicing learning what a project is.
+  it("answers which project something belongs to", async () => {
+    const created = await project();
+    const invoiceId = "00000000-0000-4000-8000-000000000002";
+    await linkToProject.call({ projectId: created.id, kind: "invoice", targetId: invoiceId }, OWNER);
+    const found = await projectsForSubject.call(
+      { kind: "invoice", targetId: invoiceId },
+      OWNER,
+    );
+    expect(found).toHaveLength(1);
+    expect(found[0]?.title).toBe("Henderson kitchen");
+  });
+
+  it("keeps a list of what has to happen, in order", async () => {
+    const created = await project();
+    const first = await addTask.call({ projectId: created.id, title: "Measure up" }, OWNER);
+    const second = await addTask.call({ projectId: created.id, title: "Order units" }, OWNER);
+    expect(first.position).toBe(0);
+    expect(second.position).toBe(1);
+
+    const done = await setTaskStatus.call({ id: first.id, status: "done" }, OWNER);
+    expect(done.doneAt).toBeTruthy();
+    // Cleared on the way back out, so "done on" is always the moment it was
+    // actually marked rather than the first time it ever was.
+    const undone = await setTaskStatus.call({ id: first.id, status: "doing" }, OWNER);
+    expect(undone.doneAt).toBeNull();
+
+    await removeTask.call({ id: second.id }, OWNER);
+    const full = await getProject.call({ id: created.id }, OWNER);
+    expect(full?.tasks).toHaveLength(1);
+    expect((await listProjects.call({}, OWNER)).find(project => project.id === created.id)?.openTasks).toBe(1);
+    await restoreTask.call({ id: second.id }, OWNER);
+    const restored = await getProject.call({ id: created.id }, OWNER);
+    expect(restored?.tasks.map(task => task.id)).toEqual([first.id, second.id]);
+    expect((await listProjects.call({}, OWNER)).find(project => project.id === created.id)?.openTasks).toBe(2);
+  });
+
+  it("counts what is still open on each job", async () => {
+    const created = await project();
+    await addTask.call({ projectId: created.id, title: "Measure up" }, OWNER);
+    const second = await addTask.call({ projectId: created.id, title: "Order units" }, OWNER);
+    await setTaskStatus.call({ id: second.id, status: "done" }, OWNER);
+
+    const listed = await listProjects.call({}, OWNER);
+    expect(listed).toHaveLength(1);
+    expect(listed[0]?.openTasks).toBe(1);
+    expect(listed[0]?.contactName).toBe("Rae Lane");
+  });
+
+  it("stamps the finish rather than letting anybody type it", async () => {
+    const created = await project();
+    const complete = await updateProject.call(
+      { id: created.id, status: "complete" },
+      OWNER,
+    );
+    expect(complete.completedAt).toBeTruthy();
+    const [row] = await db().select().from(projects).where(eq(projects.id, created.id));
+    expect(row!.status).toBe("complete");
+  });
+
+  it("records what the work achieved and how it was measured", async () => {
+    const created = await project();
+    await setOutcome.call(
+      {
+        projectId: created.id,
+        label: "Time on site",
+        value: "40",
+        unit: "%",
+        method: "First-party analytics, three months either side.",
+      },
+      OWNER,
+    );
+    const full = await getProject.call({ id: created.id }, OWNER);
+    expect(full?.outcomes[0]).toMatchObject({ label: "Time on site", value: "40" });
+    // The claim and the substantiation sit together, which is what makes an
+    // owner notice when they cannot fill the second.
+    expect(full?.outcomes[0]?.method).toContain("analytics");
+  });
+
+  // §4.7: "Before/after is a pairing, not two uploads."
+  it("insists a before and an after are actually paired", async () => {
+    const created = await project();
+    const naked = await failure(
+      attachFile.call({ projectId: created.id, assetId: await asset(), role: "before" }, OWNER),
+    );
+    expect(naked.message).toContain("pair name");
+
+    const stray = await failure(
+      attachFile.call(
+        { projectId: created.id, assetId: await asset(), role: "gallery", pairKey: "kitchen" },
+        OWNER,
+      ),
+    );
+    expect(stray.message).toContain("Only a before or after");
+
+    const before = await attachFile.call(
+      { projectId: created.id, assetId: await asset(), role: "before", pairKey: "kitchen" },
+      OWNER,
+    );
+    const after = await attachFile.call(
+      { projectId: created.id, assetId: await asset(), role: "after", pairKey: "kitchen" },
+      OWNER,
+    );
+    expect(before.pairKey).toBe("kitchen");
+    expect(after.pairKey).toBe("kitchen");
+    const rows = await db().select().from(projectFiles);
+    expect(rows).toHaveLength(2);
+  });
+
+  it("keeps the work and forgets the person", async () => {
+    const created = await project({ clientDisplayName: "The Hendersons" });
+    await updateProject.call({ id: created.id, notes: "Difficult about the tiles." }, OWNER);
+    const [contact] = await db()
+      .select({ id: contacts.id })
+      .from(contacts)
+      .where(eq(contacts.email, "rae@example.test"));
+
+    const { contactPrivacySources } = await import("@/core/privacy/service");
+    const source = contactPrivacySources().find((one) => one.scope === "contact.projects");
+    expect(source).toBeTruthy();
+    await db().transaction((tx) => source!.erase(tx, contact!.id, { requestId: "t" }));
+
+    const [after] = await db().select().from(projects).where(eq(projects.id, created.id));
+    // The business's own record of what it did survives; the person does not.
+    expect(after).toMatchObject({
+      title: "Henderson kitchen",
+      contactId: null,
+      clientDisplayName: null,
+      notes: null,
+    });
+  });
+
+  it("moves a job to the record that survives a merge", async () => {
+    await project();
+    const { contactReferences } = await import("@/core/contacts/service");
+    expect(contactReferences().some((one) => one.table === "projects")).toBe(true);
+  });
+});

package/dist/template/tests/core/promo-quote.test.ts

@@ -0,0 +1,51 @@
+// Copyright (C) 2026 Tony Aly
+// SPDX-License-Identifier: Apache-2.0
+// Integer coupon arithmetic (C5.23).
+
+import { describe, expect, it } from "vitest";
+import { allocateDiscount, percentOffMinor, quoteCoupon } from "@/modules/catalog/promo-quote";
+
+describe("coupon quotes", () => {
+  it("takes a percent off in minor units without floating point", () => {
+    expect(percentOffMinor(10_000, 100_000)).toBe(1_000);
+    expect(percentOffMinor(99, 100_000)).toBe(9);
+    expect(allocateDiscount([6000, 4000], 1000)).toEqual([600, 400]);
+    expect(allocateDiscount([1, 1, 1], 2)).toEqual([0, 0, 2]);
+  });
+
+  it("quotes percent, fixed and free shipping", () => {
+    expect(
+      quoteCoupon({
+        kind: "percent",
+        percentOffPpm: 250_000,
+        amountMinor: null,
+        currency: null,
+        minSubtotalMinor: 0,
+        cartCurrency: "CAD",
+        subtotalMinor: 8_000,
+      }),
+    ).toEqual({ discountMinor: 2_000, freeShipping: false });
+    expect(
+      quoteCoupon({
+        kind: "fixed",
+        percentOffPpm: null,
+        amountMinor: 5_000,
+        currency: "CAD",
+        minSubtotalMinor: 0,
+        cartCurrency: "CAD",
+        subtotalMinor: 3_000,
+      }),
+    ).toEqual({ discountMinor: 3_000, freeShipping: false });
+    expect(
+      quoteCoupon({
+        kind: "free_shipping",
+        percentOffPpm: null,
+        amountMinor: null,
+        currency: null,
+        minSubtotalMinor: 0,
+        cartCurrency: "CAD",
+        subtotalMinor: 2_000,
+      }),
+    ).toEqual({ discountMinor: 0, freeShipping: true });
+  });
+});

package/dist/template/tests/core/proxy-locale.test.ts

@@ -0,0 +1,55 @@
+// Copyright (C) 2026 Tony Aly
+// SPDX-License-Identifier: Apache-2.0
+// The edge must not mistake a route for a language (MASTER.md §4.9).
+//
+// `/og/services` is shaped exactly like `/fr/services`, so the prefix was
+// stripped and the request became `/services`. Every page's link-preview image
+// 404ed, and `/go/…` short links were swallowed the same way. You cannot see it
+// on the site — you see it when a page is shared and comes back blank.
+import { readdirSync } from "node:fs";
+import { join } from "node:path";
+import { NextRequest } from "next/server";
+import { describe, expect, it } from "vitest";
+import { proxy } from "../../proxy";
+
+const ROOT = join(import.meta.dirname, "..", "..");
+
+/** Where Next reports the path it rewrote to, if it rewrote at all. */
+function rewrittenTo(path: string): string | null {
+  const response = proxy(new NextRequest(`https://example.test${path}`));
+  const target = response.headers.get("x-middleware-rewrite");
+  return target ? new URL(target).pathname : null;
+}
+
+describe("locale prefixes versus route roots", () => {
+  it("treats a real language tag as a prefix", () => {
+    expect(rewrittenTo("/fr/services")).toBe("/services");
+    expect(rewrittenTo("/fr-CA/services")).toBe("/services");
+  });
+
+  it("leaves two-letter route roots alone", () => {
+    // The whole bug: these used to arrive at the route as "/services" and "/abc".
+    expect(rewrittenTo("/og/services")).not.toBe("/services");
+    expect(rewrittenTo("/go/abc")).not.toBe("/abc");
+  });
+
+  // A deny-list only works while it is complete, and the edge cannot read the
+  // filesystem at runtime. So the list is checked against the filesystem here:
+  // add a two-letter route in `app/` without listing it and this fails, rather
+  // than the next person discovering it from a blank Facebook preview.
+  it("lists every two-letter route root that exists", () => {
+    const roots = readdirSync(join(ROOT, "app"), { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name)
+      .filter((name) => !name.startsWith("(") && !name.startsWith("_"))
+      .filter((name) => /^[a-z]{2}([-][A-Za-z]{2,4})?$/.test(name));
+
+    expect(roots.length).toBeGreaterThan(0);
+    for (const root of roots) {
+      expect(
+        rewrittenTo(`/${root}/anything`),
+        `/${root} is a route in app/ but the edge treats it as a language`,
+      ).not.toBe("/anything");
+    }
+  });
+});

package/dist/template/tests/core/public-entity-drafts.test.ts

@@ -0,0 +1,166 @@
+// Copyright (C) 2026 Tony Aly
+// SPDX-License-Identifier: Apache-2.0
+// Working drafts must not mutate live public products, events or issues (C2.01).
+
+import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import { updateBusiness } from "@/core/settings/service";
+import {
+  activateProduct,
+  createProduct,
+  publishProduct,
+  resolveVisibleProduct,
+  updateProduct,
+  updateProductDescription,
+} from "@/modules/catalog/service";
+import { createTaxCategory } from "@/modules/invoicing/tax-service";
+import {
+  createEvent,
+  publishEvent,
+  resolvePublicEvent,
+  updateEvent,
+} from "@/modules/events/service";
+import {
+  createIssue,
+  createNewsletter,
+  publishIssue,
+  resolvePublicIssue,
+  updateIssue,
+} from "@/modules/newsletters/service";
+import { ANONYMOUS, closeDb, hasDatabase, OWNER, truncateSpine } from "../helpers/spine";
+
+describe.runIf(hasDatabase)("public entities keep a working draft", { timeout: 30_000 }, () => {
+  beforeEach(async () => {
+    await truncateSpine();
+    await updateBusiness.call(
+      {
+        name: "Aurora Coast Photography",
+        country: "CA",
+        baseCurrency: "CAD",
+        timezone: "America/Vancouver",
+      },
+      OWNER,
+    );
+  });
+  afterAll(closeDb);
+
+  it("lets an active product change its working copy without changing the storefront", async () => {
+    const tax = await createTaxCategory.call({ code: "standard", name: "Standard" }, OWNER);
+    const created = await createProduct.call(
+      {
+        name: "Print set",
+        slug: "print-set",
+        kind: "physical",
+        subtitle: "Coastal",
+        taxCategoryId: tax.id,
+        description: [{ id: "h", type: "heading", props: { text: "Prints", level: 2 } }],
+      },
+      OWNER,
+    );
+    const active = await activateProduct.call(
+      { id: created.id, expectedVersion: created.version },
+      OWNER,
+    );
+    const edited = await updateProduct.call(
+      { id: active.id, expectedVersion: active.version, name: "Print folio", subtitle: "Draft copy" },
+      OWNER,
+    );
+    expect(edited.name).toBe("Print set");
+    expect(edited.workingName).toBe("Print folio");
+    expect((await resolveVisibleProduct.call({ slug: "print-set" }, ANONYMOUS))?.name).toBe(
+      "Print set",
+    );
+
+    const described = await updateProductDescription.call(
+      {
+        id: edited.id,
+        expectedVersion: edited.version,
+        description: [{ id: "h", type: "heading", props: { text: "Folio", level: 2 } }],
+      },
+      OWNER,
+    );
+    expect(
+      (described.description as unknown as { props: { text: string } }[])[0]?.props.text,
+    ).toBe("Prints");
+    expect(
+      (described.workingDescription as unknown as { props: { text: string } }[])[0]?.props.text,
+    ).toBe("Folio");
+
+    const published = await publishProduct.call(
+      { id: described.id, expectedVersion: described.version },
+      OWNER,
+    );
+    expect(published.name).toBe("Print folio");
+    expect((await resolveVisibleProduct.call({ slug: "print-set" }, ANONYMOUS))?.name).toBe(
+      "Print folio",
+    );
+  });
+
+  it("lets a published event change its working copy without changing the public page", async () => {
+    const created = await createEvent.call(
+      { name: "Coast workshop", slug: "coast-workshop", summary: "A morning on the shore." },
+      OWNER,
+    );
+    const live = await publishEvent.call({ id: created.id, expectedVersion: created.version }, OWNER);
+    const edited = await updateEvent.call(
+      {
+        id: live.id,
+        expectedVersion: live.version,
+        name: "Harbour workshop",
+        summary: "Draft copy",
+      },
+      OWNER,
+    );
+    expect(edited.name).toBe("Coast workshop");
+    expect(edited.workingName).toBe("Harbour workshop");
+    expect((await resolvePublicEvent.call({ slug: "coast-workshop" }, ANONYMOUS))?.name).toBe(
+      "Coast workshop",
+    );
+
+    const published = await publishEvent.call(
+      { id: edited.id, expectedVersion: edited.version },
+      OWNER,
+    );
+    expect(published.name).toBe("Harbour workshop");
+    expect((await resolvePublicEvent.call({ slug: "coast-workshop" }, ANONYMOUS))?.name).toBe(
+      "Harbour workshop",
+    );
+  });
+
+  it("lets a published issue change its working copy without changing the archive", async () => {
+    const newsletter = await createNewsletter.call({ name: "Coast notes", slug: "coast-notes" }, OWNER);
+    const draft = await createIssue.call(
+      {
+        newsletterId: newsletter.id,
+        slug: "august-light",
+        title: "August light",
+        excerpt: "What the fog did.",
+        body: "The strait was silver.",
+      },
+      OWNER,
+    );
+    const live = await publishIssue.call({ id: draft.id, expectedVersion: draft.version }, OWNER);
+    const edited = await updateIssue.call(
+      {
+        id: live.id,
+        expectedVersion: live.version,
+        title: "September light",
+        body: "Draft copy",
+      },
+      OWNER,
+    );
+    expect(edited.title).toBe("August light");
+    expect(edited.workingTitle).toBe("September light");
+    expect((await resolvePublicIssue.call({ slug: "august-light" }, ANONYMOUS))?.title).toBe(
+      "August light",
+    );
+
+    const published = await publishIssue.call(
+      { id: edited.id, expectedVersion: edited.version },
+      OWNER,
+    );
+    expect(published.title).toBe("September light");
+    expect((await resolvePublicIssue.call({ slug: "august-light" }, ANONYMOUS))?.title).toBe(
+      "September light",
+    );
+  });
+});