create-ailk 0.1.0 → 0.2.0

package/templates/apps/web/app/[locale]/schedule/page.tsx

@@ -0,0 +1,82 @@
+// oss: false
+/**
+ * /[locale]/schedule — the scheduling module's booking page (#4633).
+ *
+ * Exists only because the `scheduling` module is installed: `create-ailk
+ * --modules marketing,scheduling` copies this directory, and a scaffold
+ * without the module never receives it (packages/create-ailk/src/surfaces.ts,
+ * the `schedule` gateable surface).
+ *
+ * API-backed rather than MDX-backed, the same shape as the `flows` surface:
+ * everything the page shows about the event — its title, its duration, its
+ * meeting type, its open slots — is DERIVED by the `booker` section from
+ * apps/api's `/v1/schedule/availability`, so there is no content file that
+ * could disagree with the calendar. The one thing the scaffolder cannot know
+ * is WHICH event to book, so that arrives as configuration.
+ *
+ * CREDENTIALS. `SCHEDULING_CAL_LINK` is read here, on the server, and it is
+ * not the API key — the key lives in apps/api's scheduling service and is
+ * never read by this app at all. `calLink` is a public identifier (it is the
+ * provider's own public booking-page path) and reaching the browser is its
+ * job: the booker sends it back to `/v1/schedule/*` to name the event. It is
+ * deliberately NOT a `NEXT_PUBLIC_` variable so that the whole scheduling
+ * config surface stays server-read, which is the rule architecture.yaml's
+ * scheduling block enforces.
+ *
+ * Unconfigured is a 404, not an error page — the flows precedent: to a
+ * visitor, a booking page for an event the operator never named is
+ * indistinguishable from a page that does not exist.
+ */
+import { SectionRenderer } from "@working-theory/ui/sections";
+import { registerSchedulingSections } from "@working-theory/ui/slices/scheduling";
+import type { PageSection } from "@working-theory/validation";
+import type { Metadata } from "next";
+import { notFound } from "next/navigation";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+// `SectionRenderer`'s oss dispatch maps `booker` to a placeholder, because the
+// real component strips with this slice; this call contributes the real one and
+// must stay an explicit statement, not a bare side-effect import (#5214 D4).
+registerSchedulingSections();
+
+/** Site-relative path of the confirmation page this module also owns. */
+const BOOKED_REDIRECT = "/schedule/confirmed";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "schedule" });
+  return { title: t("title"), description: t("description") };
+}
+
+export default async function Page({ params }: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  const calLink = process.env["SCHEDULING_CAL_LINK"];
+  if (!calLink) {
+    notFound();
+  }
+
+  const t = await getTranslations({ locale, namespace: "schedule" });
+  const sections: PageSection[] = [
+    {
+      id: "schedule-booker",
+      type: "booker",
+      data: {
+        calLink,
+        eyebrow: t("eyebrow"),
+        headline: t("headline"),
+        bookedRedirect: BOOKED_REDIRECT,
+      },
+    },
+  ];
+
+  return (
+    <main>
+      <SectionRenderer sections={sections} locale={locale} />
+    </main>
+  );
+}

package/templates/apps/web/app/[locale]/services/[slug]/page.tsx

@@ -2,9 +2,11 @@
 // next-mdx-remote/rsc, and emits a JSON-LD <script>. Unknown slugs trigger 404.
 import {
   renderPage,
+  renderPageMetadata,
   getMdxSource as defaultGetMdxSource,
   getMdxSlugs,
 } from "@working-theory/page-renderer";
+import type { Metadata } from "next";
 import { notFound } from "next/navigation";
 import type { ReactElement } from "react";
 
@@ -13,6 +15,13 @@ interface Props {
   getMdxSource?: typeof defaultGetMdxSource;
 }
 
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale, slug } = await params;
+  return renderPageMetadata({ type: "Service", slug, locale });
+}
+
 export async function generateStaticParams({
   params,
 }: {

package/templates/apps/web/app/[locale]/services/__tests__/page-renderer-migration.test.tsx

@@ -73,7 +73,7 @@ describe("ServicesPage — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(
-      `"<main><h1>Services</h1><p data-testid="section-empty-state">Services listing coming soon.</p></main>"`,
+      `"<main><h1 class="text-heading-1 font-display font-normal tracking-tighter text-fg hero-type-display">Services</h1><p data-testid="section-empty-state">Services listing coming soon.</p></main>"`,
     );
   });
 
@@ -86,7 +86,7 @@ describe("ServicesPage — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(`
-     "<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Services","description":"All services.","mainEntity":{"@type":"ItemList","itemListElement":[{"@type":"Service"}]}}</script><main><h1>Services</h1><p data-testid="services-description">All services.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source="# Services
+     "<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Services","description":"All services.","mainEntity":{"@type":"ItemList","itemListElement":[{"@type":"Service"}]}}</script><main><h1>Services</h1><p data-testid="services-description">All services.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source="# Services
 
      Body."></div></article></div></div></main>"
     `);
@@ -110,7 +110,7 @@ describe("ServiceSlugPage — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(`
-     "<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@graph":[{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"Implementation consulting","description":"Help adapting AI Launch Kit.","mainEntity":{"@context":"https://schema.org","@type":"Service","name":"Implementation consulting","description":"Help adapting AI Launch Kit."}},{"@context":"https://schema.org","@type":"BreadcrumbList","inLanguage":"en","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http://localhost:3000/en/"},{"@type":"ListItem","position":2,"name":"Services","item":"http://localhost:3000/en/services"},{"@type":"ListItem","position":3,"name":"Implementation consulting","item":"http://localhost:3000/en/services/consulting"}]}]}</script><main><h1>Implementation consulting</h1><p data-testid="service-description">Help adapting AI Launch Kit.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source="# Implementation consulting
+     "<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@graph":[{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"Implementation consulting","description":"Help adapting AI Launch Kit.","mainEntity":{"@context":"https://schema.org","@type":"Service","name":"Implementation consulting","description":"Help adapting AI Launch Kit."}},{"@context":"https://schema.org","@type":"BreadcrumbList","inLanguage":"en","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http://localhost:3000/en/"},{"@type":"ListItem","position":2,"name":"Services","item":"http://localhost:3000/en/services"},{"@type":"ListItem","position":3,"name":"Implementation consulting","item":"http://localhost:3000/en/services/consulting"}]}]}</script><main><h1>Implementation consulting</h1><p data-testid="service-description">Help adapting AI Launch Kit.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source="# Implementation consulting
 
      Body."></div></article></div></div></main>"
     `);

package/templates/apps/web/app/[locale]/services/page.tsx

@@ -1,7 +1,8 @@
 // Services list page. Reads ServicesList MDX via the content adapter and emits
 // a JSON-LD CollectionPage via the dispatcher.
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
-import { renderPage } from "@working-theory/page-renderer";
+import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
+import type { Metadata } from "next";
 import type { ReactElement } from "react";
 
 interface Props {
@@ -9,6 +10,13 @@ interface Props {
   getMdxSource?: typeof defaultGetMdxSource;
 }
 
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "ServicesList", slug: "services", locale });
+}
+
 export default async function Page({
   params,
   getMdxSource,

package/templates/apps/web/app/[locale]/sign-in/__tests__/next-path.test.ts

@@ -0,0 +1,31 @@
+/**
+ * Tests for `resolveNextPath` — the /sign-in `?next=` sanitizer (#4984).
+ * Foreign, protocol-relative, backslash, control-char, and non-string inputs
+ * all fall back; plain in-app paths pass through unchanged.
+ */
+import { resolveNextPath } from "../next-path";
+
+const FALLBACK = "/account";
+
+describe("resolveNextPath()", () => {
+  it.each(["/account", "/en/account?tab=x", "/waitlist#a"])(
+    "accepts the in-app path %p",
+    (raw) => {
+      expect(resolveNextPath(raw, FALLBACK)).toBe(raw);
+    },
+  );
+
+  it.each([
+    ["protocol-relative", "//evil.com"],
+    ["backslash host trick", "/\\evil.com"],
+    ["absolute URL", "https://evil.com"],
+    ["bare host", "evil.com"],
+    ["embedded space", "/acc ount"],
+    ["CRLF", "/x\r\ny"],
+    ["empty string", ""],
+    ["undefined", undefined],
+    ["string[] (repeated param)", ["/a"]],
+  ])("rejects %s → fallback", (_label, raw) => {
+    expect(resolveNextPath(raw, FALLBACK)).toBe(FALLBACK);
+  });
+});

package/templates/apps/web/app/[locale]/sign-in/__tests__/page.test.tsx

@@ -0,0 +1,152 @@
+/**
+ * Tests for the `/[locale]/sign-in` page (#4984).
+ *
+ * Covers:
+ *   (a) OAuth-only (google) → sso body, exactly that provider, no email
+ *       field, no sign-up footer.
+ *   (b) google + github + email → password body with both social buttons,
+ *       still no sign-up footer.
+ *   (c) zero providers → inert card (no buttons, no form, not-configured
+ *       subhead) — never a fabricated session.
+ *   (d) provider click → `signIn.social({ provider, callbackURL: next })`;
+ *       a failed launch renders the providerFailed message.
+ *   (e) a foreign / protocol-relative `?next=` falls back to /account.
+ *   (f) password submit → `signIn.email` with the typed credentials; an
+ *       error result renders the signInFailed message.
+ *
+ * `next-intl/server` is mocked globally (apps/web/__tests__/setup.ts) against
+ * the real en.json, so `signIn` copy is asserted by its real strings.
+ */
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+
+const mockGetActiveProviderIds = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth-env.ts is a pure env-introspection module with no external boundary to mock instead.
+jest.mock("../../../../lib/auth-env", () => ({
+  __esModule: true,
+  getActiveProviderIds: () => mockGetActiveProviderIds(),
+}));
+
+const mockSocial = jest.fn();
+const mockEmail = jest.fn();
+jest.mock("better-auth/react", () => ({
+  __esModule: true,
+  createAuthClient: () => ({
+    signIn: {
+      social: (...args: unknown[]) => mockSocial(...args),
+      email: (...args: unknown[]) => mockEmail(...args),
+    },
+  }),
+}));
+
+import en from "../../../../messages/en.json";
+import Page, { generateMetadata } from "../page";
+
+async function renderPage(next?: string): Promise<void> {
+  const el = await Page({
+    params: Promise.resolve({ locale: "en" }),
+    searchParams: Promise.resolve(next === undefined ? {} : { next }),
+  });
+  render(el);
+}
+
+beforeEach(() => {
+  mockGetActiveProviderIds.mockReset().mockReturnValue(["google"]);
+  mockSocial.mockReset().mockResolvedValue({ data: {}, error: null });
+  mockEmail.mockReset().mockResolvedValue({ data: {}, error: null });
+});
+
+describe("generateMetadata()", () => {
+  it("uses the signIn namespace title + description", async () => {
+    const meta = await generateMetadata({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve({}),
+    });
+    expect(meta.title).toBe(en.signIn.title);
+    expect(meta.description).toBe(en.signIn.description);
+  });
+});
+
+describe("/sign-in page", () => {
+  it("(a) OAuth-only: sso body with exactly the reported provider, no sign-up footer", async () => {
+    await renderPage("/account");
+    expect(screen.getByTestId("sign-in-page")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-card")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-sso-google")).toBeInTheDocument();
+    expect(screen.queryByTestId("auth-sso-github")).toBeNull();
+    expect(screen.queryByTestId("auth-email")).toBeNull();
+    expect(screen.queryByTestId("auth-submit")).toBeNull();
+    expect(screen.queryByTestId("auth-footer-link")).toBeNull();
+    expect(screen.queryByText(/create an account/i)).toBeNull();
+    expect(screen.getByText(en.signIn.heading)).toBeInTheDocument();
+  });
+
+  it("(b) email + OAuth: password body with both social buttons, no sign-up footer", async () => {
+    mockGetActiveProviderIds.mockReturnValue(["google", "github", "email"]);
+    await renderPage("/account");
+    expect(screen.getByTestId("auth-email")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-password")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-social-row")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-social-google")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-social-github")).toBeInTheDocument();
+    expect(screen.queryByTestId("auth-sso-stack")).toBeNull();
+    expect(screen.queryByTestId("auth-footer-link")).toBeNull();
+  });
+
+  it("(c) zero providers: inert card with the not-configured subhead, no buttons, no form", async () => {
+    mockGetActiveProviderIds.mockReturnValue([]);
+    await renderPage();
+    expect(screen.getByTestId("auth-card")).toBeInTheDocument();
+    expect(screen.queryByTestId("auth-sso-google")).toBeNull();
+    expect(screen.queryByTestId("auth-sso-github")).toBeNull();
+    expect(screen.queryByTestId("auth-submit")).toBeNull();
+    expect(screen.queryByTestId("auth-email")).toBeNull();
+    expect(screen.getByText(en.signIn.notConfiguredSubhead)).toBeInTheDocument();
+    expect(mockSocial).not.toHaveBeenCalled();
+  });
+
+  it("(d) provider click launches signIn.social with the sanitised next path", async () => {
+    const user = userEvent.setup();
+    await renderPage("/account");
+    await user.click(screen.getByTestId("auth-sso-google"));
+    expect(mockSocial).toHaveBeenCalledTimes(1);
+    expect(mockSocial).toHaveBeenCalledWith({
+      provider: "google",
+      callbackURL: "/account",
+    });
+  });
+
+  it("(d) a failed provider launch renders the providerFailed message", async () => {
+    const user = userEvent.setup();
+    mockSocial.mockResolvedValue({ data: null, error: { message: "nope" } });
+    await renderPage("/account");
+    await user.click(screen.getByTestId("auth-sso-google"));
+    expect(await screen.findByText(en.signIn.providerFailed)).toBeInTheDocument();
+  });
+
+  it("(e) a protocol-relative ?next= falls back to /account", async () => {
+    const user = userEvent.setup();
+    await renderPage("//evil.com");
+    await user.click(screen.getByTestId("auth-sso-google"));
+    expect(mockSocial).toHaveBeenCalledWith({
+      provider: "google",
+      callbackURL: "/account",
+    });
+  });
+
+  it("(f) password submit calls signIn.email and surfaces signInFailed on error", async () => {
+    const user = userEvent.setup();
+    mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+    mockEmail.mockResolvedValue({ data: null, error: { message: "bad" } });
+    await renderPage("/en/account?tab=x");
+    await user.type(screen.getByTestId("auth-email"), "ada@example.com");
+    await user.type(screen.getByTestId("auth-password"), "s3cr3t");
+    await user.click(screen.getByTestId("auth-submit"));
+    expect(mockEmail).toHaveBeenCalledWith({
+      email: "ada@example.com",
+      password: "s3cr3t",
+      callbackURL: "/en/account?tab=x",
+    });
+    expect(await screen.findByText(en.signIn.signInFailed)).toBeInTheDocument();
+  });
+});

package/templates/apps/web/app/[locale]/sign-in/page.tsx

@@ -0,0 +1,83 @@
+/**
+ * `/[locale]/sign-in` — the site's generic sign-in page (#4984).
+ *
+ * RSC: resolves the active providers from auth-env, the sign-in method
+ * (password when the email provider is active, else sso), the sanitised
+ * `?next=` return path, and the translated `signIn` labels — then renders the
+ * `SignInCard` client island. The locale layout above owns the Nav/Footer +
+ * MarketingShell frame; this page contributes only the centered card region
+ * (no nested shell).
+ *
+ * Signed-in visitors are not redirected here — the Nav's session-aware action
+ * cluster (Account / Sign out) is the affordance for them.
+ */
+
+import { localeHref } from "@working-theory/ui";
+import type { AuthCardLabels } from "@working-theory/ui/blocks";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { getActiveProviderIds } from "../../../lib/auth-env";
+import { siteLogo } from "../../../lib/site-brand";
+
+import { resolveNextPath } from "./next-path";
+import { SignInCard, type SignInProvider } from "./sign-in-card";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  searchParams: Promise<{ next?: string | string[] }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "signIn" });
+  return { title: t("title"), description: t("description") };
+}
+
+export default async function SignInPage({
+  params,
+  searchParams,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "signIn" });
+
+  const active = getActiveProviderIds();
+  // Exactly the OAuth providers auth-env reports — never a default set.
+  const providers = active.filter(
+    (id): id is SignInProvider => id === "google" || id === "github",
+  );
+  const method = active.includes("email") ? "password" : "sso";
+  const next = resolveNextPath(
+    (await searchParams).next,
+    localeHref(locale, "/account"),
+  );
+
+  const labels: AuthCardLabels = {
+    signInHeading: t("heading"),
+    signInSubhead: t("subhead"),
+    ssoPrefix: t("ssoPrefix"),
+    google: t("google"),
+    github: t("github"),
+    email: t("email"),
+    password: t("password"),
+    forgot: t("forgot"),
+    signInSubmit: t("submit"),
+    orContinue: t("orContinue"),
+  };
+
+  return (
+    <SignInCard
+      providers={providers}
+      method={method}
+      next={next}
+      logo={siteLogo()}
+      labels={labels}
+      notConfiguredSubhead={t("notConfiguredSubhead")}
+      errorLabels={{
+        signInFailed: t("signInFailed"),
+        providerFailed: t("providerFailed"),
+      }}
+    />
+  );
+}

package/templates/apps/web/app/[locale]/sign-in/sign-in-card.tsx

@@ -0,0 +1,123 @@
+"use client"; // Better Auth's client calls (signIn.social / signIn.email) + error state
+
+/**
+ * SignInCard — the /sign-in page's client island (#4984).
+ *
+ * Composes the shipped `AuthCard` block (`intent="sign-in"`, `footer="none"`)
+ * and wires its provider buttons / password form to the Better Auth client,
+ * using the SAME `createAuthClient()` idiom the `(authed)` group's
+ * `SignInGate` uses. The page (RSC) decides providers + method from auth-env
+ * and hands them in; this component never reads env itself.
+ *
+ * No sign-up affordance anywhere: `footer="none"` drops the "Not a member?
+ * Create an account" cross-link (Better Auth `emailAndPassword.disableSignUp`
+ * posture).
+ *
+ * Password path: `apps/web/auth.ts` does not enable `emailAndPassword` today,
+ * so `signIn.email` is wired but inert (Better Auth answers with an error)
+ * until an operator enables it server-side — the page only selects
+ * `method="password"` when auth-env reports the "email" provider.
+ *
+ * Zero providers (method sso, providers []): the card renders in its inert
+ * state — heading + `notConfiguredSubhead`, no buttons, no form. Never a
+ * fabricated session.
+ *
+ * Error surface: AuthCard's `errors` prop is per-field. A failed provider
+ * launch lands on `errors.email` — the social row sits inside the password
+ * form beside the email field, so it renders there. The SSO body has no
+ * fields at all, so for `method="sso"` the same message is rendered as an
+ * `Alert` above the card instead.
+ */
+
+import { AuthCard, type AuthCardLabels } from "@working-theory/ui/blocks";
+import { Alert, AlertDescription } from "@working-theory/ui/primitives";
+import { createAuthClient } from "better-auth/react";
+import type { ReactElement, ReactNode } from "react";
+import { useState } from "react";
+
+const authClient = createAuthClient();
+
+/** The OAuth providers this page can launch — a subset of AuthCard's. */
+export type SignInProvider = "google" | "github";
+
+export interface SignInCardProps {
+  /** Active OAuth providers, exactly as auth-env reports them. */
+  providers: SignInProvider[];
+  /** "password" when the email provider is active; otherwise "sso". */
+  method: "sso" | "password";
+  /** Sanitised post-sign-in path (see `next-path.ts`). */
+  next: string;
+  /** Brand mark rendered top-center inside the card. */
+  logo?: ReactNode;
+  /** Translated AuthCard labels (resolved server-side by the page). */
+  labels: AuthCardLabels;
+  /** Subhead shown when no provider is configured. */
+  notConfiguredSubhead: string;
+  /** Translated error copy. */
+  errorLabels: { signInFailed: string; providerFailed: string };
+}
+
+type FieldErrors = { email?: string; password?: string };
+
+export function SignInCard({
+  providers,
+  method,
+  next,
+  logo,
+  labels,
+  notConfiguredSubhead,
+  errorLabels,
+}: SignInCardProps): ReactElement {
+  const [errors, setErrors] = useState<FieldErrors>({});
+  const [providerError, setProviderError] = useState<string | null>(null);
+
+  const notConfigured = method === "sso" && providers.length === 0;
+
+  const launchProvider = async (provider: SignInProvider): Promise<void> => {
+    setProviderError(null);
+    // Better Auth reports a failed launch as `{ error }`; a network/runtime
+    // failure rejects. Both land on the same providerFailed message.
+    const failed = await authClient.signIn
+      .social({ provider, callbackURL: next })
+      .then((res) => Boolean(res?.error), () => true);
+    if (failed) {
+      setProviderError(errorLabels.providerFailed);
+      setErrors((prev) => ({ ...prev, email: errorLabels.providerFailed }));
+    }
+  };
+
+  const submitPassword = async (email: string, password: string): Promise<void> => {
+    setErrors({});
+    const res = await authClient.signIn.email({ email, password, callbackURL: next });
+    if (res?.error) setErrors({ password: errorLabels.signInFailed });
+  };
+
+  return (
+    <div
+      className="flex min-h-screen items-center justify-center py-section"
+      data-testid="sign-in-page"
+    >
+      <div className="flex w-full max-w-md flex-col gap-4">
+        {method === "sso" && providerError ? (
+          <Alert variant="error" data-testid="sign-in-provider-error">
+            <AlertDescription>{providerError}</AlertDescription>
+          </Alert>
+        ) : null}
+        <AuthCard
+          intent="sign-in"
+          method={method}
+          footer="none"
+          {...(logo !== undefined ? { logo } : {})}
+          {...(notConfigured ? { subhead: notConfiguredSubhead } : {})}
+          providers={providers.map((provider) => ({
+            provider,
+            onClick: () => void launchProvider(provider),
+          }))}
+          onSubmit={(data) => void submitPassword(data.email, data.password ?? "")}
+          errors={errors}
+          labels={labels}
+        />
+      </div>
+    </div>
+  );
+}

package/templates/apps/web/app/[locale]/software/[slug]/page.tsx

@@ -1,7 +1,12 @@
 // SoftwareProduct detail page. Reads the SoftwareProduct MDX for the given slug,
 // renders via @working-theory/page-renderer, and emits a JSON-LD <script>. Unknown slugs 404.
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
-import { getMdxSlugs, renderPage } from "@working-theory/page-renderer";
+import {
+  getMdxSlugs,
+  renderPage,
+  renderPageMetadata,
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
 import type { ReactElement } from "react";
 
 interface Props {
@@ -9,6 +14,13 @@ interface Props {
   getMdxSource?: typeof defaultGetMdxSource;
 }
 
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale, slug } = await params;
+  return renderPageMetadata({ type: "SoftwareProduct", slug, locale });
+}
+
 export async function generateStaticParams({
   params,
 }: {

package/templates/apps/web/app/[locale]/software/__tests__/page-renderer-migration.test.tsx

@@ -61,7 +61,7 @@ describe("software/[slug] — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(`
-     "<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"@working-theory/page-renderer","description":"Single rendering primitive for MDX-wired routes.","mainEntity":{"@type":"SoftwareApplication","name":"@working-theory/page-renderer"}}</script><main><h1>@working-theory/page-renderer</h1><p data-testid="software-description">Single rendering primitive for MDX-wired routes.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-rendered">## Overview
+     "<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"@working-theory/page-renderer","description":"Single rendering primitive for MDX-wired routes.","mainEntity":{"@context":"https://schema.org","@type":"SoftwareApplication","name":"@working-theory/page-renderer","description":"Single rendering primitive for MDX-wired routes."}}</script><main><h1>@working-theory/page-renderer</h1><p data-testid="software-description">Single rendering primitive for MDX-wired routes.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-rendered">## Overview
 
      Body content.</div></article></div></div></main>"
     `);

package/templates/apps/web/app/[locale]/tech-articles/[slug]/page.tsx

@@ -1,7 +1,12 @@
 // TechArticle detail page. Reads the TechArticle MDX for the given slug, renders via
 // @working-theory/page-renderer, and emits a JSON-LD <script>. Unknown slugs trigger 404.
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
-import { getMdxSlugs, renderPage } from "@working-theory/page-renderer";
+import {
+  getMdxSlugs,
+  renderPage,
+  renderPageMetadata,
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
 import type { ReactElement } from "react";
 
 interface Props {
@@ -9,6 +14,13 @@ interface Props {
   getMdxSource?: typeof defaultGetMdxSource;
 }
 
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale, slug } = await params;
+  return renderPageMetadata({ type: "TechArticle", slug, locale });
+}
+
 export async function generateStaticParams({
   params,
 }: {