create-ailk 0.11.0 → 0.11.2

package/templates/apps/api/src/routes/checkout/sessions.ts

@@ -28,13 +28,14 @@
  *     (backward-compat for OSS standalone deployments). See #935.
  *   - Same-origin redirects (#6877): a request that did not pass an ENABLED
  *     internal-auth gate (the OSS default) must send successUrl and cancelUrl
- *     on the site's own origin — `FRONTEND_URL`'s, exact scheme + host + port,
- *     checked on the raw string as well as on the parse, because the raw
- *     string is what Stripe receives. Anything else is a 400 before any Stripe
- *     call or database read. A caller authenticated by X-Internal-Auth keeps
- *     its redirects; that exemption holds only while every internal caller
- *     builds its redirects itself — an internal caller MUST NEVER forward a
- *     redirect taken from its own end user.
+ *     each on one of the trusted browser origins — `config.TRUSTED_ORIGINS`
+ *     (#7395: FRONTEND_URL's origin plus AILK_TRUSTED_ORIGINS), exact scheme +
+ *     host + port, checked on the raw string as well as on the parse, because
+ *     the raw string is what Stripe receives. Anything else is a 400 before
+ *     any Stripe call or database read. A caller authenticated by
+ *     X-Internal-Auth keeps its redirects; that exemption holds only while
+ *     every internal caller builds its redirects itself — an internal caller
+ *     MUST NEVER forward a redirect taken from its own end user.
  *
  * Error mapping:
  *   401 internal-auth-required — X-Internal-Auth missing/mismatch (only when env var set)
@@ -44,8 +45,8 @@
  *   500 stripe-not-configured — STRIPE_SECRET_KEY is missing/empty (no Stripe call)
  *   500 live-mode-forbidden   — STRIPE_SECRET_KEY is a live key
  *   500 config-error          — STRIPE_SECRET_KEY invalid configuration (from the SDK wrapper),
- *                               or FRONTEND_URL is not an absolute http(s) URL / is unset in
- *                               production when the origin lock applies (#6877)
+ *                               or no trusted browser origin is configured when the origin
+ *                               lock applies (#6877, #7395)
  *   502 checkout-unavailable  — Stripe SDK threw an unexpected error
  */
 import { timingSafeEqual } from "node:crypto";
@@ -154,26 +155,6 @@ function internalAuthVerdict(
 
 // ── Same-origin redirect lock (#6877) ────────────────────────────────────────
 
-/**
- * The site's own origin, from `FRONTEND_URL` (#6877 D6). `null` when the
- * setting does not parse, parses to a non-http(s) scheme (whose origin would
- * be the literal `"null"`), or is unset in production — where the config
- * default `http://localhost:3000` would lock a live site to localhost.
- */
-function siteRedirectOrigin(): string | null {
-  if (!process.env["FRONTEND_URL"] && config.NODE_ENV === "production") {
-    return null;
-  }
-  let parsed: URL;
-  try {
-    parsed = new URL(config.FRONTEND_URL);
-  } catch {
-    return null;
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
-  return parsed.origin;
-}
-
 /** C0 controls, space, DEL and backslash — anything a parser may normalize. */
 // eslint-disable-next-line no-control-regex -- the control-character range is exactly what D2 check 1 must refuse.
 const NON_CANONICAL_URL_CHAR = /[\u0000-\u0020\u007f\\]/;
@@ -225,7 +206,7 @@ async function resolveBuyer(
   request: FastifyRequest,
 ): Promise<{ buyer?: Buyer; identity?: IdentityReason }> {
   const cookieUser = await resolveOptionalCookieUser(request, {
-    frontendOrigin: config.FRONTEND_URL,
+    trustedOrigins: config.TRUSTED_ORIGINS,
   });
   if (cookieUser.kind === "none") {
     return cookieUser.reason === "no_cookie"
@@ -279,16 +260,21 @@ export async function checkoutSessionsHandler(
 
   // ── Same-origin redirect lock (#6877) — before any Stripe or DB call ──────
   if (authVerdict === "open") {
-    const siteOrigin = siteRedirectOrigin();
-    if (siteOrigin === null) {
+    // An empty list is FRONTEND_URL unset in production or unusable, with no
+    // AILK_TRUSTED_ORIGINS (#7395 D4) — refused before any Stripe or DB call.
+    const trustedOrigins = config.TRUSTED_ORIGINS;
+    if (trustedOrigins.length === 0) {
       request.log.error(
         { method: request.method, path: request.url },
-        "[checkout] FRONTEND_URL is not a valid absolute URL",
+        "[checkout] no trusted browser origin is configured",
       );
       return reply.status(500).send({ error: "config-error" });
     }
     const refused = (["successUrl", "cancelUrl"] as const).filter(
-      (field) => !isSameOriginRedirect(parsed.data[field], siteOrigin),
+      (field) =>
+        !trustedOrigins.some((origin) =>
+          isSameOriginRedirect(parsed.data[field], origin),
+        ),
     );
     if (refused.length > 0) {
       // Field names only — the refused URL is never logged or echoed.

package/templates/apps/api/src/routes/project-listings/__tests__/me.test.ts

@@ -267,7 +267,7 @@ function installFixtureMocks(): void {
 async function buildApp(): Promise<FastifyInstance> {
   const app = Fastify();
   await app.register(async (authScope) => {
-    await authScope.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+    await authScope.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
     await authScope.register(projectListingMeRoute);
   });
   await app.ready();

package/templates/apps/api/src/server.ts

@@ -512,18 +512,19 @@ async function assertCommerceSandboxKey(key: string): Promise<void> {
  * #6889 (SEC-02 of the #6876 security review) — make the checkout route's
  * posture observable. POST /v1/checkout/sessions admits a caller without
  * X-Internal-Auth when OSS_API_INTERNAL_SECRET is unset. With FRONTEND_URL
- * unset, the route's same-origin redirect lock (#6877) answers 500
- * config-error to that caller, and the CORS and cookie-CSRF origin checks pin
- * to the `http://localhost:3000` config default. Both stay optional (OSS
- * standalone compat), so this only ever WARNS — once per unset variable, and
- * only in production. FRONTEND_URL is read from the raw environment because
- * `config.FRONTEND_URL` carries that localhost default.
+ * unset in production, the trusted-origin list (#7395) holds only
+ * AILK_TRUSTED_ORIGINS — with that unset too, CORS and cookie writes refuse
+ * every browser origin and the redirect lock (#6877) answers 500
+ * config-error to that caller. Both stay optional (OSS standalone compat), so
+ * this only ever WARNS — once per unset variable, and only in production.
+ * FRONTEND_URL is read from the raw environment because `config.FRONTEND_URL`
+ * carries a localhost default.
  */
 function warnOnUnsetProductionProtections(): void {
   if (config.NODE_ENV !== "production") return;
   if (!process.env["FRONTEND_URL"]) {
     logger.warn(
-      "[startup] FRONTEND_URL not set in production — CORS/cookie origin checks are pinned to http://localhost:3000, and checkout answers 500 config-error to any caller admitted without X-Internal-Auth",
+      "[startup] FRONTEND_URL not set in production — CORS, cookie-authenticated writes and checkout redirects trust only AILK_TRUSTED_ORIGINS; with neither set, all three refuse every browser origin and checkout answers 500 config-error to any caller admitted without X-Internal-Auth",
     );
   }
   if (!process.env["OSS_API_INTERNAL_SECRET"]) {
@@ -645,12 +646,16 @@ export async function build() {
   // never reach the client. Full detail still goes to pino at error level.
   registerErrorSerializer(server);
 
-  // Register CORS — public read API + same-origin auth callers.
-  // With FRONTEND_URL unset: reflect any origin in dev/test (zero-config
-  // boot) but fail CLOSED in production — `origin: true` combined with
-  // `credentials: true` would let any website read credentialed responses
-  // (security review M1). `false` disables cross-origin access entirely;
-  // same-origin and non-browser callers are unaffected.
+  // Register CORS — public read API + the trusted browser origins (#7395).
+  // `origin` is ALWAYS a copy of `config.TRUSTED_ORIGINS`, the frozen list
+  // config/index.ts resolves once at startup from FRONTEND_URL and
+  // AILK_TRUSTED_ORIGINS (no `*`, no wildcard host). @fastify/cors echoes a
+  // request's Origin only on an exact match against that array, and writes no
+  // allow-origin header otherwise; an empty list means no cross-origin caller.
+  // Never pass `true`, a function, a RegExp or a delegator here, and never set
+  // a per-route `cors` option: with `credentials: true`, reflecting any origin
+  // would let any website read credentialed responses (security review M1).
+  // Same-origin and non-browser callers are unaffected.
   //
   // `methods` is EXPLICIT because @fastify/cors defaults it to `GET,HEAD,POST`
   // (its own `defaultOptions`), which is narrower than the surface this server
@@ -666,7 +671,7 @@ export async function build() {
   // live route table on every run, so a route added in a NEW method fails there
   // rather than silently becoming unreachable from a browser.
   //
-  // This widens WHICH METHODS the allowed origin may use, never WHO is allowed:
+  // This widens WHICH METHODS the allowed origins may use, never WHO is allowed:
   // `origin` and `credentials` are untouched.
   //
   // `allowedHeaders` is deliberately left unset: null means @fastify/cors
@@ -674,7 +679,7 @@ export async function build() {
   // and `content-type` pass without this file having to maintain a list that
   // silently drops a header a future route needs.
   await server.register(cors, {
-    origin: config.FRONTEND_URL || config.NODE_ENV !== "production",
+    origin: [...config.TRUSTED_ORIGINS],
     credentials: true,
     methods: ["GET", "HEAD", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
   });
@@ -726,7 +731,7 @@ export async function build() {
   // handlers. Cookie-first, Bearer-fallback; see middleware/auth.ts.
   await server.register(async (authScope) => {
     await authScope.register(authPreHandlerPlugin, {
-      frontendOrigin: config.FRONTEND_URL,
+      trustedOrigins: config.TRUSTED_ORIGINS,
     });
     await authScope.register(tokenRoutes);
     await authScope.register(userRoutes);

package/templates/apps/mcp/package.json

@@ -28,7 +28,7 @@
     "@working-theory/metadata": "workspace:*",
     "@working-theory/schema": "workspace:*",
     "@working-theory/validation": "workspace:*",
-    "fastify": "^5.12.1",
+    "fastify": "^5.12.5",
     "yaml": "^2.9.0",
     "zod": "^4.2.1"
   },

package/templates/apps/web/CLAUDE.md

@@ -14,7 +14,7 @@ Inherits root `CLAUDE.md`. This file adds web-specific rules.
 
 ## Always do first
 
-- For any UI work: invoke the `frontend-design` skill before writing code.
+- For any UI work: read § Theme & styling and § Iterate visually below before writing code. To add a whole page, run the `/ailk:add-page` skill.
 - For any page-rendering or schema-emission work: read `packages/schema/README.md` (catalog) and `packages/schema/CLAUDE.md` (operational layer + component map) if you haven't this session.
 - For content authoring questions: read `content/CLAUDE.md` first.
 - For a full page build, follow the per-page loop (Content intent → Layout → Author content → Visual iterate). The visual-iterate step uses `screenshots/` as scratch (see § Iterate visually).

package/templates/apps/web/app/[locale]/careers/[slug]/page.tsx

@@ -3,7 +3,6 @@
 // Careers list at /careers links here; each job posting lives at /careers/<slug>.
 import {
   getMdxSource as defaultGetMdxSource,
-  getMdxSlugs,
   renderPage,
   renderPageMetadata,
 } from "@working-theory/page-renderer";
@@ -23,15 +22,6 @@ export async function generateMetadata({
   return renderPageMetadata({ type: "JobPosting", slug, locale });
 }
 
-export async function generateStaticParams({
-  params,
-}: {
-  params: { locale: string };
-}): Promise<{ slug: string }[]> {
-  const slugs = await getMdxSlugs("JobPosting", params.locale);
-  return slugs.map((slug: string) => ({ slug }));
-}
-
 export default async function Page({
   params,
   getMdxSource = defaultGetMdxSource,

package/templates/apps/web/app/[locale]/case-studies/[slug]/page.tsx

@@ -2,7 +2,6 @@
 // next-mdx-remote/rsc, and emits a JSON-LD <script>. Unknown slugs trigger 404.
 import {
   getMdxSource as defaultGetMdxSource,
-  getMdxSlugs,
   renderPage,
   renderPageMetadata,
 } from "@working-theory/page-renderer";
@@ -22,15 +21,6 @@ export async function generateMetadata({
   return renderPageMetadata({ type: "CaseStudy", slug, locale });
 }
 
-export async function generateStaticParams({
-  params,
-}: {
-  params: { locale: string };
-}): Promise<{ slug: string }[]> {
-  const slugs = await getMdxSlugs("CaseStudy", params.locale);
-  return slugs.map((slug: string) => ({ slug }));
-}
-
 export default async function Page({
   params,
   getMdxSource = defaultGetMdxSource,

package/templates/apps/web/app/[locale]/courses/[slug]/page.tsx

@@ -1,11 +1,7 @@
 // Course detail page. Reads the Course MDX for the given slug, renders via
 // @working-theory/page-renderer, and emits a JSON-LD <script>. Unknown slugs trigger 404.
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
-import {
-  getMdxSlugs,
-  renderPage,
-  renderPageMetadata,
-} from "@working-theory/page-renderer";
+import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
 import type { Metadata } from "next";
 import type { ReactElement } from "react";
 
@@ -21,15 +17,6 @@ export async function generateMetadata({
   return renderPageMetadata({ type: "Course", slug, locale });
 }
 
-export async function generateStaticParams({
-  params,
-}: {
-  params: { locale: string };
-}): Promise<{ slug: string }[]> {
-  const slugs = await getMdxSlugs("Course", params.locale);
-  return slugs.map((slug) => ({ slug }));
-}
-
 export default async function Page({
   params,
   getMdxSource,

package/templates/apps/web/app/[locale]/events/[slug]/page.tsx

@@ -4,7 +4,6 @@ import {
   renderPage,
   renderPageMetadata,
   getMdxSource as defaultGetMdxSource,
-  getMdxSlugs,
 } from "@working-theory/page-renderer";
 import type { Metadata } from "next";
 import { notFound } from "next/navigation";
@@ -22,15 +21,6 @@ export async function generateMetadata({
   return renderPageMetadata({ type: "Event", slug, locale });
 }
 
-export async function generateStaticParams({
-  params,
-}: {
-  params: { locale: string };
-}): Promise<{ slug: string }[]> {
-  const slugs = await getMdxSlugs("Event", params.locale);
-  return slugs.map((slug) => ({ slug }));
-}
-
 export default async function Page({
   params,
   getMdxSource = defaultGetMdxSource,

package/templates/apps/web/app/[locale]/features/[slug]/page.tsx

@@ -7,7 +7,6 @@
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
 import {
   getMdxSource as loadMdxSource,
-  getMdxSlugs,
   renderPage,
   renderPageMetadata,
 } from "@working-theory/page-renderer";
@@ -26,15 +25,6 @@ export async function generateMetadata({
   return renderPageMetadata({ type: "Feature", slug, locale });
 }
 
-export async function generateStaticParams({
-  params,
-}: {
-  params: { locale: string };
-}): Promise<{ slug: string }[]> {
-  const slugs = await getMdxSlugs("Feature", params.locale);
-  return slugs.map((slug) => ({ slug }));
-}
-
 export default async function Page({
   params,
   getMdxSource,

package/templates/apps/web/app/[locale]/for/[slug]/page.tsx

@@ -7,7 +7,6 @@
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
 import {
   getMdxSource as loadMdxSource,
-  getMdxSlugs,
   renderPage,
   renderPageMetadata,
 } from "@working-theory/page-renderer";
@@ -26,15 +25,6 @@ export async function generateMetadata({
   return renderPageMetadata({ type: "UseCase", slug, locale });
 }
 
-export async function generateStaticParams({
-  params,
-}: {
-  params: { locale: string };
-}): Promise<{ slug: string }[]> {
-  const slugs = await getMdxSlugs("UseCase", params.locale);
-  return slugs.map((slug) => ({ slug }));
-}
-
 export default async function Page({
   params,
   getMdxSource,

package/templates/apps/web/app/[locale]/how-to/[slug]/page.tsx

@@ -1,11 +1,7 @@
 // HowTo detail page. Reads the HowTo MDX for the given slug, renders via
 // @working-theory/page-renderer, and emits a JSON-LD <script>. Unknown slugs trigger 404.
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
-import {
-  getMdxSlugs,
-  renderPage,
-  renderPageMetadata,
-} from "@working-theory/page-renderer";
+import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
 import type { Metadata } from "next";
 import type { ReactElement } from "react";
 
@@ -21,15 +17,6 @@ export async function generateMetadata({
   return renderPageMetadata({ type: "HowTo", slug, locale });
 }
 
-export async function generateStaticParams({
-  params,
-}: {
-  params: { locale: string };
-}): Promise<{ slug: string }[]> {
-  const slugs = await getMdxSlugs("HowTo", params.locale);
-  return slugs.map((slug) => ({ slug }));
-}
-
 export default async function Page({
   params,
   getMdxSource,

package/templates/apps/web/app/[locale]/integrations/[slug]/page.tsx

@@ -4,7 +4,6 @@ import {
   renderPage,
   renderPageMetadata,
   getMdxSource as defaultGetMdxSource,
-  getMdxSlugs,
 } from "@working-theory/page-renderer";
 import type { Metadata } from "next";
 import { notFound } from "next/navigation";
@@ -22,15 +21,6 @@ export async function generateMetadata({
   return renderPageMetadata({ type: "Integration", slug, locale });
 }
 
-export async function generateStaticParams({
-  params,
-}: {
-  params: { locale: string };
-}): Promise<{ slug: string }[]> {
-  const slugs = await getMdxSlugs("Integration", params.locale);
-  return slugs.map((slug) => ({ slug }));
-}
-
 export default async function Page({
   params,
   getMdxSource = defaultGetMdxSource,

package/templates/apps/web/app/[locale]/layout.tsx

@@ -48,7 +48,10 @@ import type { ReactElement, ReactNode } from "react";
 
 import { auth } from "../../auth";
 import { GoogleAnalytics } from "../../components/google-analytics";
-import { SignOutTrigger } from "../../components/sign-out-trigger";
+import {
+  SignedInNav,
+  type SignedInNavProps,
+} from "../../components/signed-in-nav";
 import { isAuthPath } from "../../lib/auth-routes";
 import { assertEnabledLocale } from "../../lib/locale-guard";
 import { footerColumns, navItems } from "../../lib/nav-config";
@@ -83,10 +86,11 @@ type ThemeMode = "light" | "dark";
  * and `flow` (open a StepFlow lightbox). The `flow` kind + Nav's
  * `renderFlowTrigger` composer is Nav's ONE caller-composed seam (#4341): the
  * caller receives the rendered trigger `<Button>` and decides what wraps it.
- * The layout uses that seam WITHOUT a lightbox — `renderFlowTrigger` below
- * replaces both signed-in triggers (Account → a non-navigating name label,
- * Sign out → `SignOutTrigger`), so this flow config is NEVER rendered. It only
- * has to satisfy the type: one minimal fields-step and a dead `action`.
+ * The layout uses that seam WITHOUT a lightbox — `SignedInNav`'s
+ * `renderFlowTrigger` replaces both signed-in triggers (Account → a
+ * non-navigating name label, Sign out → `SignOutTrigger`), so this flow config
+ * is NEVER rendered. It only has to satisfy the type: one minimal fields-step
+ * and a dead `action`.
  */
 const NAV_CLIENT_ACTION_FLOW: NavActionFlow["flow"] = {
   steps: [
@@ -314,7 +318,8 @@ export default async function LocaleLayout({
   // the service shapes now roster both). Signed in → the user's name (a
   // non-navigating label) + an outline-strong "Sign out"; both authored as
   // `kind: "flow"` so Nav hands their triggers back through
-  // `renderFlowTrigger` (see NAV_CLIENT_ACTION_FLOW above).
+  // `renderFlowTrigger`, which `SignedInNav` owns (see NAV_CLIENT_ACTION_FLOW
+  // above).
   const navActions: NavAction[] = session
     ? [
         { labelKey: "account", kind: "flow", flow: NAV_CLIENT_ACTION_FLOW },
@@ -331,15 +336,17 @@ export default async function LocaleLayout({
         { labelKey: "signUp", path: "/sign-up", variant: "primary" },
       ];
 
-  // Only compose the flow seam when there is a flow action to compose. This
-  // layout is a Server Component and `renderFlowTrigger` is a function, so
-  // passing it is only legal when Nav actually consumes it here rather than
-  // forwarding it across the RSC boundary into NavMobileMenu ("use client").
-  // Passing it unconditionally crashed EVERY signed-out render — the whole of a
-  // fresh scaffold, which configures no auth provider — with "Functions cannot
-  // be passed directly to Client Components". Nav itself already guards its own
-  // forward the same way (chrome/Nav.tsx: `{...(renderFlowTrigger ? … : {})}`);
-  // this is the caller half of that contract.
+  // A flow action needs `renderFlowTrigger`, a function — and this layout is a
+  // Server Component. Nav forwards that function into NavMobileMenu ("use
+  // client"), and React cannot serialize a function across the RSC boundary:
+  // passing it from here crashed EVERY signed-in page with "Functions cannot be
+  // passed directly to Client Components" (#7402). Nav's own
+  // `{...(renderFlowTrigger ? … : {})}` guard only skips the forward when the
+  // function is undefined; it never makes passing one legal. So a flow action
+  // routes the whole Nav through `SignedInNav` ("use client"), which defines
+  // `renderFlowTrigger` and imports `navItems` (icon components are functions
+  // too) on the client side. Without one, Nav stays a Server Component and
+  // nothing callable crosses.
   const hasFlowAction = navActions.some((action) => action.kind === "flow");
 
   // Shared brand mark injected into both Nav and Footer chrome slots. The
@@ -388,6 +395,33 @@ export default async function LocaleLayout({
   // `(marketing)` group — a ~35-directory move for a five-page delta (spec D1).
   const isAuthRoute = isAuthPath(pathname, enabledLocales);
 
+  // Every Nav prop that is safe to serialize — shared verbatim by the
+  // server-rendered Nav (signed out) and `SignedInNav` (signed in), which adds
+  // `navItems` and `renderFlowTrigger` on its own side of the RSC boundary.
+  const navProps: SignedInNavProps = {
+    locale,
+    labels: navLabels,
+    // Deck home (#5697): the two forwards that join #5426 D4 to a real deck.
+    // `sticky` pins the bar — MarketingShell renders {nav} as a plain child of
+    // the scroll container, so under `scroll-snap-type: y mandatory` the
+    // browser snaps slide 1 to the top on load and the unpinned bar is gone
+    // before the reader touches anything. `deckMorph` is what puts BrandLogo's
+    // `.ailk-deck-brand-mark` / `.ailk-deck-brand-wordmark` hooks in the
+    // document for the D4 CSS to key off; it requires both `logo` and
+    // `wordmark` (Nav.tsx:344), which are passed below. Scoped to the SAME
+    // `isDeckHome` gate MarketingShell's snap/deckHero use, so a non-deck
+    // route's render is byte-identical to before this branch existed.
+    ...(isDeckHome ? { sticky: true, deckMorph: true } : {}),
+    siteName: SITE_NAME,
+    frame: "contained",
+    navAlignment: "right",
+    showThemeToggle: false,
+    logo: brandLogo,
+    wordmark: brandWordmark,
+    overflowLabel: navOverflowLabel,
+    actions: navActions,
+  };
+
   // Placeholder social handles (#5469 D5): `{{COMPANY_HANDLE}}` is a
   // create-ailk marker substituted at scaffold time
   // (packages/create-ailk/src/programmatic.ts), so a customer's site never
@@ -582,47 +616,14 @@ export default async function LocaleLayout({
                 ? { snap: "mandatory" as const, deckHero: true }
                 : {})}
               nav={
-                <Nav
-                  locale={locale}
-                  labels={navLabels}
-                  navItems={siteChrome.nav === "mark-only" ? [] : navItems}
-                  // Deck home (#5697): the two forwards that join #5426 D4 to a
-                  // real deck. `sticky` pins the bar — MarketingShell renders
-                  // {nav} as a plain child of the scroll container, so under
-                  // `scroll-snap-type: y mandatory` the browser snaps slide 1 to
-                  // the top on load and the unpinned bar is gone before the
-                  // reader touches anything. `deckMorph` is what puts BrandLogo's
-                  // `.ailk-deck-brand-mark` / `.ailk-deck-brand-wordmark` hooks in
-                  // the document for the D4 CSS to key off; it requires both
-                  // `logo` and `wordmark` (Nav.tsx:344), which the layout already
-                  // passes above. Scoped to the SAME `isDeckHome` gate
-                  // MarketingShell's snap/deckHero use, so a non-deck route's
-                  // render is byte-identical to before this branch existed.
-                  {...(isDeckHome ? { sticky: true, deckMorph: true } : {})}
-                  siteName={SITE_NAME}
-                  frame="contained"
-                  navAlignment="right"
-                  showThemeToggle={false}
-                  logo={brandLogo}
-                  wordmark={brandWordmark}
-                  overflowLabel={navOverflowLabel}
-                  actions={navActions}
-                  {...(hasFlowAction
-                    ? {
-                        renderFlowTrigger: (action, trigger) =>
-                          action.labelKey === "signOut" ? (
-                            <SignOutTrigger>{trigger}</SignOutTrigger>
-                          ) : (
-                            <span
-                              className="text-body-sm text-(--color-text-muted)"
-                              data-testid="nav-account-name"
-                            >
-                              {navLabels.items.account}
-                            </span>
-                          ),
-                      }
-                    : {})}
-                />
+                hasFlowAction ? (
+                  <SignedInNav {...navProps} />
+                ) : (
+                  <Nav
+                    {...navProps}
+                    navItems={siteChrome.nav === "mark-only" ? [] : navItems}
+                  />
+                )
               }
               footer={
                 <Footer

package/templates/apps/web/app/[locale]/partners/[slug]/page.tsx

@@ -2,7 +2,6 @@
 // next-mdx-remote/rsc, and emits a JSON-LD <script>. Unknown slugs trigger 404.
 import {
   getMdxSource as defaultGetMdxSource,
-  getMdxSlugs,
   renderPage,
   renderPageMetadata,
 } from "@working-theory/page-renderer";
@@ -22,15 +21,6 @@ export async function generateMetadata({
   return renderPageMetadata({ type: "Partner", slug, locale });
 }
 
-export async function generateStaticParams({
-  params,
-}: {
-  params: { locale: string };
-}): Promise<{ slug: string }[]> {
-  const slugs = await getMdxSlugs("Partner", params.locale);
-  return slugs.map((slug: string) => ({ slug }));
-}
-
 export default async function Page({
   params,
   getMdxSource = defaultGetMdxSource,

package/templates/apps/web/app/[locale]/portfolio/[slug]/page.tsx

@@ -4,7 +4,6 @@
 // NO_HAND_IMPLEMENT_OK: /build-starter operator-directed live pass (#6687).
 import {
   getMdxSource as defaultGetMdxSource,
-  getMdxSlugs,
   renderPage,
   renderPageMetadata,
 } from "@working-theory/page-renderer";
@@ -24,15 +23,6 @@ export async function generateMetadata({
   return renderPageMetadata({ type: "PortfolioItem", slug, locale });
 }
 
-export async function generateStaticParams({
-  params,
-}: {
-  params: { locale: string };
-}): Promise<{ slug: string }[]> {
-  const slugs = await getMdxSlugs("PortfolioItem", params.locale);
-  return slugs.map((slug: string) => ({ slug }));
-}
-
 export default async function Page({
   params,
   getMdxSource = defaultGetMdxSource,

package/templates/apps/web/app/[locale]/products/[slug]/page.tsx

@@ -4,7 +4,6 @@ import {
   renderPage,
   renderPageMetadata,
   getMdxSource as defaultGetMdxSource,
-  getMdxSlugs,
 } from "@working-theory/page-renderer";
 import type { Metadata } from "next";
 import { notFound } from "next/navigation";
@@ -22,15 +21,6 @@ export async function generateMetadata({
   return renderPageMetadata({ type: "Product", slug, locale });
 }
 
-export async function generateStaticParams({
-  params,
-}: {
-  params: { locale: string };
-}): Promise<{ slug: string }[]> {
-  const slugs = await getMdxSlugs("Product", params.locale);
-  return slugs.map((slug) => ({ slug }));
-}
-
 export default async function Page({
   params,
   getMdxSource = defaultGetMdxSource,