create-ailk 0.1.0 → 0.2.0

package/templates/apps/web/app/[locale]/projects/apply/ListingApplicationClient.tsx

@@ -0,0 +1,110 @@
+"use client";
+
+/**
+ * ListingApplicationClient — the REFERENCE MOUNT for the founder application
+ * (#5048).
+ *
+ * This file is the whole per-site cost of the consumer surface, and it is
+ * deliberately this short. Before it, a site had to hand-write three proxy
+ * routes, a form that saved on every advance, and a decision about where a
+ * bearer token lives. What is left is: bind `projectListings` to the section,
+ * and decide what to do with the token when `start` mints one.
+ *
+ * IT IS NOT A BFF, and a site must not copy it into one (the placement
+ * decision's D4). `apps/api` is called DIRECTLY: an agent-mediated caller
+ * (#5039) cannot use any site's proxy, so the direct path has to be safe on
+ * its own terms regardless — and it is, because `siteId` is resolved
+ * server-side from the public site key rather than taken from the body. A
+ * proxy would be convenience, not a security boundary.
+ *
+ * TOKEN CUSTODY (#5048 (a)). The token is caller-held. This mount reads a
+ * resume link's `id` and `token` query parameters and passes them straight to
+ * the section; when `start` mints a new pair it replaces the URL's query
+ * parameters with them, so a founder who reloads or navigates back keeps their
+ * draft. That is a deliberate choice with a cost: a token in a URL lands in
+ * browser history and in any `Referer` the page sends. It is the accepted cost
+ * of a resume link that has to survive being EMAILED and opened in a cold
+ * browser (samhenry #316 D6b), which is the constraint that rules out an
+ * httpOnly cookie entirely. A site with different constraints replaces this
+ * one function; nothing else here changes.
+ *
+ * NO ANTI-AUTOMATION CONTROLS. No honeypot, no timing check, deliberately —
+ * see #316 D6b and #5039.
+ *
+ * SHIPS NO COPY, AND NO ROUTE. Every string comes from the `config` and
+ * `messages` a caller passes in. There is deliberately no `page.tsx` beside
+ * this file: a route would need a question set, and a question set is the
+ * SITE's content — shipping a placeholder one here would put founder-readable
+ * copy in the template, which is exactly what this unit exists to stop. A site
+ * adds its own route, imports this wrapper, and passes its own config.
+ */
+
+import { projectListings } from "@working-theory/api-client";
+import { ListingApplicationFlow } from "@working-theory/ui";
+import type {
+  FlowStepperMessages,
+  ListingApplicationDraftClient,
+  ListingApplicationMessages,
+} from "@working-theory/ui";
+import type { ListingApplicationConfig } from "@working-theory/validation";
+import { useRouter, useSearchParams } from "next/navigation";
+import type { ReactElement, ReactNode } from "react";
+
+/**
+ * `projectListings` satisfies the section's structural client contract as-is —
+ * `start`, `patchDraft` and `submit` already have the right shapes, and the
+ * section defines the interface rather than importing this package so that
+ * `packages/ui` stays transport-agnostic (#3957 D2).
+ */
+const client: ListingApplicationDraftClient = projectListings;
+
+/** The query parameters an emailed resume link carries. */
+const DRAFT_ID_PARAM = "draft";
+const RESUME_TOKEN_PARAM = "token";
+
+interface Props {
+  config: ListingApplicationConfig;
+  locale: string;
+  messages: FlowStepperMessages & ListingApplicationMessages;
+  /** Rendered under the live tile — the per-listing privacy notice goes here. */
+  tileFooter?: ReactNode;
+}
+
+export function ListingApplicationClient({
+  config,
+  locale,
+  messages,
+  tileFooter,
+}: Props): ReactElement {
+  const router = useRouter();
+  const params = useSearchParams();
+
+  const draftId = params.get(DRAFT_ID_PARAM);
+  const resumeToken = params.get(RESUME_TOKEN_PARAM);
+  const resume =
+    draftId && resumeToken ? { id: draftId, resumeToken } : undefined;
+
+  return (
+    <ListingApplicationFlow
+      config={config}
+      locale={locale}
+      messages={messages}
+      client={client}
+      {...(resume ? { resume } : {})}
+      {...(tileFooter !== undefined ? { tileFooter } : {})}
+      onDraftStarted={({ id, resumeToken: token }) => {
+        // Put the pair in the URL so a reload or a back-navigation resumes
+        // rather than starting a second draft. `replace`, not `push`: the
+        // founder should not have to walk back through one history entry per
+        // step. The site's own email send goes here too — the same two values
+        // are what its resume link carries.
+        const next = new URLSearchParams(params.toString());
+        next.set(DRAFT_ID_PARAM, id);
+        next.set(RESUME_TOKEN_PARAM, token);
+        router.replace(`?${next.toString()}`, { scroll: false });
+      }}
+    />
+  );
+}
+
+export default ListingApplicationClient;

package/templates/apps/web/app/[locale]/projects/apply/__tests__/ListingApplicationClient.test.tsx

@@ -0,0 +1,96 @@
+/**
+ * #5048 — the reference mount.
+ *
+ * Two things are worth pinning here and nothing else is: that an emailed
+ * resume link's query parameters reach the section as a resume, and that a
+ * freshly-minted draft's id and token are written back into the URL rather
+ * than into a cookie or browser storage. Everything else about the surface is
+ * tested where it lives, in `packages/ui`.
+ */
+import { render, screen } from "@testing-library/react";
+
+const replace = jest.fn();
+let searchParams = new URLSearchParams();
+
+jest.mock("next/navigation", () => ({
+  useRouter: () => ({ replace }),
+  useSearchParams: () => searchParams,
+}));
+
+// The section is the subject of its own tests; here it is a probe that records
+// what the mount handed it.
+const received: Record<string, unknown>[] = [];
+jest.mock("@working-theory/ui", () => ({
+  ListingApplicationFlow: (props: Record<string, unknown>) => {
+    received.push(props);
+    return <div data-testid="listing-application-flow" />;
+  },
+}));
+
+jest.mock("@working-theory/api-client", () => ({
+  projectListings: { start: jest.fn(), patchDraft: jest.fn(), submit: jest.fn() },
+}));
+
+// The import sits below the mocks deliberately: `jest.mock` calls are hoisted,
+// but the module under test must not be evaluated before they are registered.
+import { ListingApplicationClient } from "../ListingApplicationClient";
+
+const config = { slug: "apply", defaultLocale: "en", siteKey: "pk_test", steps: [] };
+const messages = {} as never;
+
+function mount() {
+  return render(
+    <ListingApplicationClient
+      config={config as never}
+      locale="en"
+      messages={messages}
+    />,
+  );
+}
+
+beforeEach(() => {
+  received.length = 0;
+  replace.mockClear();
+  searchParams = new URLSearchParams();
+});
+
+describe("ListingApplicationClient", () => {
+  it("passes no resume when the URL carries no link parameters", () => {
+    mount();
+    expect(screen.getByTestId("listing-application-flow")).toBeInTheDocument();
+    expect(received[0]).not.toHaveProperty("resume");
+  });
+
+  it("rehydrates a draft from an emailed resume link's query parameters", () => {
+    searchParams = new URLSearchParams("draft=listing_7&token=tok_from_the_email");
+    mount();
+    expect(received[0]!["resume"]).toEqual({
+      id: "listing_7",
+      resumeToken: "tok_from_the_email",
+    });
+  });
+
+  it("needs BOTH parameters — a half link is not a resume", () => {
+    searchParams = new URLSearchParams("draft=listing_7");
+    mount();
+    expect(received[0]).not.toHaveProperty("resume");
+  });
+
+  it("writes a newly minted draft back into the URL, not into a cookie", () => {
+    mount();
+    const onDraftStarted = received[0]!["onDraftStarted"] as (s: {
+      id: string;
+      resumeToken: string;
+    }) => void;
+    onDraftStarted({ id: "listing_9", resumeToken: "tok_new" });
+
+    expect(replace).toHaveBeenCalledWith(
+      "?draft=listing_9&token=tok_new",
+      { scroll: false },
+    );
+    // The token is caller-held by design (#5048 (a)) — an httpOnly cookie
+    // cannot travel in an emailed link and a non-browser caller cannot present
+    // one at all. Nothing here may quietly set one.
+    expect(document.cookie).toBe("");
+  });
+});

package/templates/apps/web/app/[locale]/projects/page.tsx

@@ -4,7 +4,8 @@ import type {
   getMdxSource as defaultGetMdxSource,
   getPageSections as defaultGetPageSections,
 } from "@working-theory/page-renderer";
-import { renderPage } from "@working-theory/page-renderer";
+import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
+import type { Metadata } from "next";
 import type { ReactElement } from "react";
 
 interface Props {
@@ -13,6 +14,17 @@ interface Props {
   getPageSections?: typeof defaultGetPageSections;
 }
 
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({
+    type: "ProjectsList",
+    slug: "projects",
+    locale,
+  });
+}
+
 export default async function Page({
   params,
   getMdxSource,

package/templates/apps/web/app/[locale]/resources/[slug]/page.tsx

@@ -7,7 +7,9 @@ import {
   getMdxSlugs,
   getMdxSource as defaultGetMdxSourceImpl,
   renderPage,
+  renderPageMetadata,
 } from "@working-theory/page-renderer";
+import type { Metadata } from "next";
 import { notFound } from "next/navigation";
 import type { ReactElement } from "react";
 
@@ -16,6 +18,13 @@ interface Props {
   getMdxSource?: typeof defaultGetMdxSource;
 }
 
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale, slug } = await params;
+  return renderPageMetadata({ type: "ResourceDetail", slug, locale });
+}
+
 export async function generateStaticParams({
   params,
 }: {

package/templates/apps/web/app/[locale]/resources/__tests__/page-renderer-migration.test.tsx

@@ -19,6 +19,16 @@ import { render } from "@testing-library/react";
 
 // ── @working-theory/ui mock ─────────────────────────────────────────────────────────────
 jest.mock("@working-theory/ui", () => ({
+  // #4446/#4447: renderPage's own fallback/empty-state title now composes
+  // Heading (mobile type-budget classes, #4417) instead of a bare <h1>.
+  Heading: ({
+    children,
+    level,
+  }: {
+    children: React.ReactNode;
+    level: number;
+  }): React.ReactElement =>
+    React.createElement(`h${level}`, null, children),
   SectionRenderer: ({ sections }: { sections: unknown[] }) =>
     React.createElement("div", {
       "data-testid": "section-renderer",
@@ -71,7 +81,7 @@ describe("ResourcesPage — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(
-      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Resources","description":"Guides, templates, and tools.","mainEntity":{"@type":"ItemList"}}</script><main><h1>Resources</h1><p data-testid="resources-description">Guides, templates, and tools.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source=""></div></article></div></div></main>"`,
+      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Resources","description":"Guides, templates, and tools.","mainEntity":{"@type":"ItemList"}}</script><main><h1>Resources</h1><p data-testid="resources-description">Guides, templates, and tools.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source=""></div></article></div></div></main>"`,
     );
   });
 });
@@ -101,7 +111,7 @@ describe("ResourceDetailPage — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(
-      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@graph":[{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"Getting Started","description":"A guide for new users.","mainEntity":{"@type":"Article","headline":"Getting Started"}},{"@context":"https://schema.org","@type":"BreadcrumbList","inLanguage":"en","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http://localhost:3000/en/"},{"@type":"ListItem","position":2,"name":"Resources","item":"http://localhost:3000/en/resources"},{"@type":"ListItem","position":3,"name":"Getting Started","item":"http://localhost:3000/en/resources/getting-started"}]}]}</script><main><h1>Getting Started</h1><p data-testid="resource-description">A guide for new users.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source=""></div></article></div></div></main>"`,
+      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@graph":[{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"Getting Started","description":"A guide for new users.","mainEntity":{"@context":"https://schema.org","@type":"Article","headline":"Getting Started","description":"A guide for new users."}},{"@context":"https://schema.org","@type":"BreadcrumbList","inLanguage":"en","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http://localhost:3000/en/"},{"@type":"ListItem","position":2,"name":"Resources","item":"http://localhost:3000/en/resources"},{"@type":"ListItem","position":3,"name":"Getting Started","item":"http://localhost:3000/en/resources/getting-started"}]}]}</script><main><h1>Getting Started</h1><p data-testid="resource-description">A guide for new users.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source=""></div></article></div></div></main>"`,
     );
   });
 

package/templates/apps/web/app/[locale]/resources/page.tsx

@@ -3,7 +3,8 @@
 import type {
   getMdxSource as defaultGetMdxSource,
 } from "@working-theory/page-renderer";
-import { renderPage } from "@working-theory/page-renderer";
+import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
+import type { Metadata } from "next";
 import type { ReactElement } from "react";
 
 interface Props {
@@ -11,6 +12,17 @@ interface Props {
   getMdxSource?: typeof defaultGetMdxSource;
 }
 
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({
+    type: "ResourcesHub",
+    slug: "resources",
+    locale,
+  });
+}
+
 export default async function Page({
   params,
   getMdxSource,

package/templates/apps/web/app/[locale]/schedule/__tests__/page.test.tsx

@@ -0,0 +1,117 @@
+// oss: false
+/**
+ * Tests for the scheduling module's booking route (#4633).
+ *
+ * Two things matter here and nothing else does. The page must hand the booker
+ * the event identifier and the module's own confirmation path, so a successful
+ * booking lands on this site rather than on the provider's; and it must never
+ * put a credential into the section data, because section data is exactly what
+ * crosses into the client island.
+ */
+import React from "react";
+import { render } from "@testing-library/react";
+
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  notFound: jest.fn(() => {
+    throw new Error("NEXT_NOT_FOUND");
+  }),
+}));
+
+jest.mock("next-intl/server", () => ({
+  __esModule: true,
+  // Echo the key back so an assertion names the message key, not the copy —
+  // the copy is the consuming site's to change.
+  getTranslations: jest.fn().mockResolvedValue((key: string) => key),
+}));
+
+// Capture what the page hands the catalog rather than rendering the real
+// booker: the island's own behaviour is covered in packages/ui, and mounting it
+// here would put a network stub between this test and the thing it asserts.
+const capturedSections: unknown[] = [];
+jest.mock("@working-theory/ui/sections", () => ({
+  __esModule: true,
+  SectionRenderer: ({ sections }: { sections: unknown[] }) => {
+    capturedSections.splice(0, capturedSections.length, ...sections);
+    return React.createElement("div", {
+      "data-testid": "section-renderer",
+      "data-section-count": String(sections.length),
+    });
+  },
+}));
+
+import { notFound } from "next/navigation";
+import SchedulePage from "../page";
+
+const mockNotFound = notFound as jest.MockedFunction<typeof notFound>;
+
+const CAL_LINK = "acme/intro-call";
+
+describe("SchedulePage — the module's booking route", () => {
+  const originalEnv = process.env["SCHEDULING_CAL_LINK"];
+
+  beforeEach(() => {
+    mockNotFound.mockClear();
+    capturedSections.length = 0;
+    process.env["SCHEDULING_CAL_LINK"] = CAL_LINK;
+  });
+
+  afterAll(() => {
+    if (originalEnv === undefined) delete process.env["SCHEDULING_CAL_LINK"];
+    else process.env["SCHEDULING_CAL_LINK"] = originalEnv;
+  });
+
+  it("renders one booker section from the catalog", async () => {
+    const element = await SchedulePage({
+      params: Promise.resolve({ locale: "en" }),
+    });
+    const { container } = render(element);
+
+    expect(
+      container.querySelector('[data-testid="section-renderer"]'),
+    ).not.toBeNull();
+    expect(capturedSections).toHaveLength(1);
+    expect((capturedSections[0] as { type: string }).type).toBe("booker");
+  });
+
+  it("sends a successful booking to the page this module owns", async () => {
+    render(await SchedulePage({ params: Promise.resolve({ locale: "en" }) }));
+    expect(capturedSections).toHaveLength(1);
+
+    const data = (capturedSections[0] as { data: Record<string, unknown> }).data;
+    expect(data["calLink"]).toBe(CAL_LINK);
+    expect(data["bookedRedirect"]).toBe("/schedule/confirmed");
+  });
+
+  it("puts no credential into the section data the client island receives", async () => {
+    render(await SchedulePage({ params: Promise.resolve({ locale: "en" }) }));
+    // Fixture self-guard: an empty capture would make every assertion below
+    // pass vacuously.
+    expect(capturedSections).toHaveLength(1);
+
+    // Whatever the page decides to pass, the SHAPE is fixed: the event
+    // identifier, page framing, and the redirect. Anything else appearing here
+    // is a value crossing into the browser that nobody decided to send.
+    const data = (capturedSections[0] as { data: Record<string, unknown> }).data;
+    expect(Object.keys(data).sort()).toEqual([
+      "bookedRedirect",
+      "calLink",
+      "eyebrow",
+      "headline",
+    ]);
+    // Belt and braces: no serialized value may contain a credential-shaped
+    // string, however the page came by it.
+    const serialized = JSON.stringify(data);
+    expect(serialized).not.toMatch(/api[_-]?key/i);
+    expect(serialized).not.toMatch(/\bcal_(live|test)_/);
+  });
+
+  it("404s when no event is configured", async () => {
+    delete process.env["SCHEDULING_CAL_LINK"];
+
+    await expect(
+      SchedulePage({ params: Promise.resolve({ locale: "en" }) }),
+    ).rejects.toThrow("NEXT_NOT_FOUND");
+    expect(mockNotFound).toHaveBeenCalled();
+  });
+});

package/templates/apps/web/app/[locale]/schedule/confirmed/__tests__/page.test.tsx

@@ -0,0 +1,96 @@
+// oss: false
+/**
+ * Tests for the scheduling module's confirmation route (#4633).
+ *
+ * The page's whole claim is that it is finished but owns no design: it renders
+ * real content from the site's own message catalog, through the site's own
+ * catalog components, and contributes no styling of its own. Both halves are
+ * asserted — that it renders a full page rather than a placeholder, and that
+ * every string in it came from the `schedule` namespace rather than from this
+ * file.
+ */
+import React from "react";
+import { render } from "@testing-library/react";
+
+const requestedKeys: string[] = [];
+jest.mock("next-intl/server", () => ({
+  __esModule: true,
+  getTranslations: jest.fn().mockResolvedValue((key: string) => {
+    requestedKeys.push(key);
+    return `copy:${key}`;
+  }),
+}));
+
+const capturedSections: unknown[] = [];
+jest.mock("@working-theory/ui/sections", () => ({
+  __esModule: true,
+  SectionRenderer: ({ sections }: { sections: unknown[] }) => {
+    capturedSections.splice(0, capturedSections.length, ...sections);
+    return React.createElement("div", {
+      "data-testid": "section-renderer",
+      "data-section-count": String(sections.length),
+    });
+  },
+}));
+
+import ConfirmedPage, { generateMetadata } from "../page";
+
+describe("ConfirmedPage — the module-owned confirmation page", () => {
+  beforeEach(() => {
+    capturedSections.length = 0;
+    requestedKeys.length = 0;
+  });
+
+  it("renders a finished page, not a placeholder", async () => {
+    const element = await ConfirmedPage({
+      params: Promise.resolve({ locale: "en" }),
+    });
+    const { container } = render(element);
+
+    expect(
+      container.querySelector('[data-testid="section-renderer"]'),
+    ).not.toBeNull();
+    // Confirmation, what happens next, and a way onward — three sections, all
+    // populated. A stub would be one section or none.
+    expect(capturedSections.map((s) => (s as { type: string }).type)).toEqual([
+      "hero",
+      "content-block",
+      "cta",
+    ]);
+  });
+
+  it("takes every string from the site's own message catalog", async () => {
+    render(await ConfirmedPage({ params: Promise.resolve({ locale: "en" }) }));
+    expect(capturedSections).toHaveLength(3);
+
+    // Every rendered value resolved through getTranslations, so changing the
+    // copy is an edit to messages/<locale>.json — not a fork of this route.
+    const serialized = JSON.stringify(capturedSections);
+    for (const value of serialized.matchAll(/"(?:headline|subheadline|body|description|label)":"([^"]*)"/g)) {
+      expect(value[1]).toMatch(/^copy:confirmed\./);
+    }
+    expect(requestedKeys.length).toBeGreaterThan(0);
+    expect(requestedKeys.every((k) => k.startsWith("confirmed."))).toBe(true);
+  });
+
+  it("declares no styling of its own — the site's design system decides", async () => {
+    render(await ConfirmedPage({ params: Promise.resolve({ locale: "en" }) }));
+    // Fixture self-guard: an empty capture would make the assertion vacuous.
+    expect(capturedSections).toHaveLength(3);
+
+    // No className, no color, no spacing anywhere in what the page contributes.
+    // This is what lets a site with its own design system adopt the page
+    // without fighting it.
+    const serialized = JSON.stringify(capturedSections);
+    expect(serialized).not.toMatch(/className|style|#[0-9a-fA-F]{3,8}\b/);
+  });
+
+  it("is not indexable", async () => {
+    // Reachable only by having just booked; indexing it would surface a
+    // confirmation page to people who never made a booking.
+    const metadata = await generateMetadata({
+      params: Promise.resolve({ locale: "en" }),
+    });
+    expect(metadata.robots).toEqual({ index: false, follow: true });
+  });
+});

package/templates/apps/web/app/[locale]/schedule/confirmed/page.tsx

@@ -0,0 +1,92 @@
+// oss: false
+/**
+ * /[locale]/schedule/confirmed — the scheduling module's confirmation page
+ * (#4633). The destination `BookerIsland` navigates to the moment the booking
+ * POST resolves (its `bookedRedirect` prop), so the visitor never leaves this
+ * site to find out the booking worked.
+ *
+ * The module OWNS this page. It is not a marketing page that happens to follow
+ * a booker: it ships with the module, it is gated with the module, and a
+ * scaffold without the module has no such route. That is why it lives under
+ * `schedule/` rather than at `/thanks/<slug>` — `/thanks` is a core marketing
+ * surface every scaffold carries, and a page in it would outlive the module
+ * that gave it a reason to exist.
+ *
+ * FINISHED, NOT A STUB — and it owns no design of its own. Every visual
+ * decision resolves through the consuming site's theme tokens and its
+ * `SectionRenderer` catalog; this file contributes a section list and nothing
+ * else. The copy is read from the site's own `schedule` message namespace,
+ * so customizing the page is an edit to `messages/<locale>.json` — the same
+ * surface the site already edits for every other page — not a fork of this
+ * route. A site whose design system differs has nothing here to fight.
+ *
+ * Carries no booking detail because it receives none: the redirect is a
+ * client-side `router.push` with no state, and re-reading the booking would
+ * mean a second provider call to tell the visitor something the confirmation
+ * email already carries. It confirms, and it says what happens next.
+ *
+ * `noindex`: a booking confirmation is reachable only by having just booked.
+ */
+import { SectionRenderer } from "@working-theory/ui/sections";
+import type { PageSection } from "@working-theory/validation";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "schedule" });
+  return {
+    title: t("confirmed.title"),
+    description: t("confirmed.description"),
+    robots: { index: false, follow: true },
+  };
+}
+
+export default async function Page({ params }: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "schedule" });
+
+  const sections: PageSection[] = [
+    {
+      id: "schedule-confirmed-hero",
+      type: "hero",
+      data: {
+        headline: t("confirmed.headline"),
+        subheadline: t("confirmed.subheadline"),
+      },
+    },
+    {
+      id: "schedule-confirmed-prepare",
+      type: "content-block",
+      data: {
+        headline: t("confirmed.prepareHeadline"),
+        body: t("confirmed.prepareBody"),
+      },
+    },
+    {
+      id: "schedule-confirmed-cta",
+      type: "cta",
+      data: {
+        headline: t("confirmed.ctaHeadline"),
+        description: t("confirmed.ctaDescription"),
+        primaryCta: { label: t("confirmed.ctaPrimaryLabel"), href: "/" },
+        secondaryCta: {
+          label: t("confirmed.ctaSecondaryLabel"),
+          href: "/contact",
+          variant: "ghost",
+        },
+      },
+    },
+  ];
+
+  return (
+    <main>
+      <SectionRenderer sections={sections} locale={locale} />
+    </main>
+  );
+}