create-ailk 0.14.0 → 0.16.0

package/templates/apps/web/app/api/hub-session/sign-in/route.ts

@@ -0,0 +1,76 @@
+/**
+ * Start a sign-in through the hub (#7894 D2, D7) — `GET /api/hub-session/sign-in?next=<path>`.
+ *
+ * Mints a `state` and a PKCE verifier (32 random bytes each, base64url), seals
+ * them with the sanitized `next` into the flow cookie for ten minutes, and
+ * sends the visitor to the hub's `/api/auth/hub/authorize` with the S256
+ * challenge. The redirect URI is this site's configured origin plus
+ * `/api/hub-session/callback` — never derived from the request's `Host`.
+ *
+ *   - not a hub-mode spoke (`SIGN_IN_PROVIDER` is not `"hub"`): 404;
+ *   - hub mode but not configured: 303 to `/account`, whose gate says so.
+ *
+ * Nothing here logs the state, the verifier or the challenge.
+ */
+import { createHash, randomBytes } from "node:crypto";
+
+import { hubSessionConfig } from "../../../../lib/hub-session/config";
+import { seal } from "../../../../lib/hub-session/seal";
+import {
+  HUB_SESSION_FALLBACK_PATH,
+  cookieHeader,
+  flowCookieName,
+  hubNextPath,
+} from "../../../../lib/hub-session/session";
+import { SIGN_IN_PROVIDER } from "../../../../lib/topology.generated";
+
+/** How long a sign-in may take on the hub before the flow cookie expires. */
+const FLOW_TTL_SECONDS = 600;
+
+/** The hub's browser step (spec 7894 D4). */
+const AUTHORIZE_PATH = "/api/auth/hub/authorize";
+
+function see(location: string, setCookie?: string): Response {
+  const headers = new Headers({
+    Location: location,
+    "Cache-Control": "no-store",
+    "Referrer-Policy": "no-referrer",
+  });
+  if (setCookie !== undefined) headers.append("Set-Cookie", setCookie);
+  return new Response(null, { status: 303, headers });
+}
+
+// platform-decisions-waiver: api-versioning — sign-in redirect endpoint, not a versioned API contract (spec 7894 §7)
+export function GET(request: Request): Response {
+  if (SIGN_IN_PROVIDER !== "hub") return new Response(null, { status: 404 });
+  const config = hubSessionConfig();
+  if (config === null) return see(HUB_SESSION_FALLBACK_PATH);
+
+  const next = hubNextPath(new URL(request.url).searchParams.get("next"));
+  const state = randomBytes(32).toString("base64url");
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+
+  const name = flowCookieName(config);
+  const flow = seal(
+    { v: 1, state, verifier, next, expiresAt: Date.now() + FLOW_TTL_SECONDS * 1000 },
+    config.sessionSecret,
+    "flow",
+    name,
+  );
+
+  const authorize = new URL(AUTHORIZE_PATH, config.hubOrigin);
+  authorize.search = new URLSearchParams({
+    response_type: "code",
+    client_id: config.clientId,
+    redirect_uri: config.redirectUri,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+  }).toString();
+
+  return see(
+    authorize.toString(),
+    cookieHeader(name, flow, FLOW_TTL_SECONDS, config),
+  );
+}

package/templates/apps/web/app/api/hub-session/sign-out/route.ts

@@ -0,0 +1,63 @@
+/**
+ * Sign out of a spoke that signs in through its hub (#7894 D7) — `POST /api/hub-session/sign-out`.
+ *
+ * The signed-in Nav's "Sign out" posts here (`SIGN_OUT_ENDPOINT`). It revokes
+ * the credential at the hub (best-effort: a hub that cannot be reached still
+ * leaves the visitor signed out here), clears the session cookie and answers
+ * 204.
+ *
+ * Same-origin only: a `Sec-Fetch-Site` other than `same-origin`, an `Origin`
+ * that is not this site's configured origin, or a request carrying neither is
+ * refused 403 before anything is revoked, so another site cannot sign a
+ * visitor out. POST only — Next answers 405 to any other method.
+ */
+import { hubSignIn } from "@working-theory/api-client";
+
+import { hubSessionConfig } from "../../../../lib/hub-session/config";
+import {
+  cookieHeader,
+  readHubSessionPayload,
+  sessionCookieName,
+} from "../../../../lib/hub-session/session";
+import { SIGN_IN_PROVIDER } from "../../../../lib/topology.generated";
+
+/** Whether `request` comes from a page on `siteOrigin`. */
+function isSameOrigin(request: Request, siteOrigin: string | null): boolean {
+  const fetchSite = request.headers.get("sec-fetch-site");
+  const origin = request.headers.get("origin");
+  if (fetchSite === null && origin === null) return false;
+  if (fetchSite !== null && fetchSite !== "same-origin") return false;
+  if (origin !== null && origin !== siteOrigin) return false;
+  return true;
+}
+
+// platform-decisions-waiver: api-versioning — sign-in redirect endpoint, not a versioned API contract (spec 7894 §7)
+export async function POST(request: Request): Promise<Response> {
+  if (SIGN_IN_PROVIDER !== "hub") return new Response(null, { status: 404 });
+  const config = hubSessionConfig();
+  if (!isSameOrigin(request, config?.siteOrigin ?? null)) {
+    return new Response(null, { status: 403 });
+  }
+  if (config === null) return new Response(null, { status: 204 });
+
+  const payload = readHubSessionPayload(request.headers);
+  if (payload !== null) {
+    try {
+      await hubSignIn.revoke(
+        { clientId: config.clientId, clientSecret: config.clientSecret },
+        { accessToken: payload.accessToken },
+      );
+    } catch (err) {
+      console.error(
+        `[hub-session] revoke failed errName=${err instanceof Error ? err.name : "unknown"}`,
+      );
+    }
+  }
+  return new Response(null, {
+    status: 204,
+    headers: {
+      "Cache-Control": "no-store",
+      "Set-Cookie": cookieHeader(sessionCookieName(config), "", 0, config),
+    },
+  });
+}

package/templates/apps/web/app/openapi.json/__tests__/route.test.ts

@@ -15,13 +15,29 @@
 
 import { GET } from "../route";
 
+// The generated topology seam (#7426 D5), mocked so each case picks its
+// topology: the hub cases below run against `"hub"`, exactly as before; the
+// spoke cases (D12) flip it. Mocked rather than imported because the hub
+// render imports `../auth`, which this route never touches.
+const mockTopology: { value: "hub" | "spoke" } = { value: "hub" };
+// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426 D5), not a runtime input; the seam IS the boundary between a hub and a spoke build, and there is no env or HTTP surface that selects it.
+jest.mock("../../../lib/topology.generated", () => ({
+  get TOPOLOGY() {
+    return mockTopology.value;
+  },
+}));
+
 const SPEC = {
   openapi: "3.1.0",
   info: { title: "Example API", version: "1.0.0" },
   paths: { "/v1/content/search": {} },
 };
 
-const API_ENV = ["AILK_API_URL", "NEXT_PUBLIC_AILK_API_URL"] as const;
+const API_ENV = [
+  "AILK_API_URL",
+  "NEXT_PUBLIC_AILK_API_URL",
+  "NEXT_PUBLIC_BASE_URL",
+] as const;
 const saved: Record<string, string | undefined> = {};
 let fetchSpy: jest.SpyInstance;
 
@@ -34,6 +50,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  mockTopology.value = "hub";
   for (const name of API_ENV) {
     if (saved[name] === undefined) delete process.env[name];
     else process.env[name] = saved[name];
@@ -88,6 +105,21 @@ describe("GET /openapi.json", () => {
     expect(requestedUrl()).toBe("https://api.example.com/v1/openapi.json");
   });
 
+  // #7874 D12 — the hub case above runs the committed (hub) render of the
+  // browser API origin seam unmocked; the spoke render reads no env at all.
+  it("skips the NEXT_PUBLIC_AILK_API_URL fallback under the seam's spoke render", async () => {
+    process.env["NEXT_PUBLIC_AILK_API_URL"] = "https://api.example.com/";
+    apiAnswers(200, JSON.stringify(SPEC));
+    await jest.isolateModulesAsync(async () => {
+      jest.doMock("../../../lib/api-origin.generated", () => ({
+        browserApiOrigin: (): string | undefined => undefined,
+      }));
+      const spoke = await import("../route");
+      await spoke.GET();
+    });
+    expect(requestedUrl()).toBe("http://localhost:3001/v1/openapi.json");
+  });
+
   it("answers 502, not 404, when the API cannot be reached", async () => {
     fetchSpy.mockRejectedValue(new TypeError("fetch failed"));
 
@@ -174,3 +206,74 @@ describe("GET /openapi.json", () => {
     expect(await response.text()).not.toContain("api.internal");
   });
 });
+
+describe("GET /openapi.json on a spoke (#7426 D12)", () => {
+  const HUB_SPEC = {
+    openapi: "3.1.0",
+    info: { title: "Hub API", version: "1.0.0" },
+    servers: [{ url: "https://hub.example.com", description: "The hub" }],
+    paths: {
+      "/v1/leads/submit": {
+        post: { summary: "Submit a lead" },
+        get: { summary: "Not relayed" },
+      },
+      "/v1/schedule/availability": {
+        get: {
+          summary: "Availability",
+          servers: [{ url: "https://hub.example.com/schedule" }],
+        },
+      },
+      "/v1/content/search": { get: { summary: "Hub-only search" } },
+      "/v1/admin/sites": { post: { summary: "Hub-only admin" } },
+    },
+  };
+
+  beforeEach(() => {
+    mockTopology.value = "spoke";
+    process.env["AILK_API_URL"] = "https://hub.example.com";
+    process.env["NEXT_PUBLIC_BASE_URL"] = "https://spoke.example.com";
+  });
+
+  it("names only this spoke's own origin in servers[]", async () => {
+    apiAnswers(200, JSON.stringify(HUB_SPEC));
+
+    const response = await GET();
+    const body = (await response.json()) as { servers: unknown };
+
+    expect(response.status).toBe(200);
+    expect(body.servers).toEqual([{ url: "https://spoke.example.com" }]);
+    expect(JSON.stringify(body)).not.toContain("hub.example.com");
+  });
+
+  it("keeps only the paths and methods the relay forwards", async () => {
+    apiAnswers(200, JSON.stringify(HUB_SPEC));
+
+    const body = (await (await GET()).json()) as {
+      paths: Record<string, Record<string, unknown>>;
+    };
+
+    expect(body.paths).toEqual({
+      "/v1/leads/submit": { post: { summary: "Submit a lead" } },
+      "/v1/schedule/availability": { get: { summary: "Availability" } },
+    });
+  });
+
+  it("still reads the hub's document at AILK_API_URL", async () => {
+    apiAnswers(200, JSON.stringify(HUB_SPEC));
+
+    await GET();
+
+    expect(requestedUrl()).toBe("https://hub.example.com/v1/openapi.json");
+  });
+
+  it("on a hub, leaves servers[] and paths as the API declared them", async () => {
+    mockTopology.value = "hub";
+    apiAnswers(200, JSON.stringify(HUB_SPEC));
+
+    const body = (await (await GET()).json()) as typeof HUB_SPEC;
+
+    expect(body.servers).toEqual(HUB_SPEC.servers);
+    expect(body.paths).toEqual(HUB_SPEC.paths);
+    expect(JSON.stringify(body)).toContain("hub.example.com");
+  });
+});

package/templates/apps/web/app/openapi.json/route.ts

@@ -15,8 +15,19 @@
  * When the API cannot be reached, or answers anything but an OpenAPI
  * document with a 200, this route answers 502 with a JSON error that names no
  * upstream origin, and is never cached.
+ *
+ * On a spoke (#7426 D12) the API is the hub's, so the document is rewritten
+ * to describe THIS host only: `servers[]` becomes this site's own origin, and
+ * `paths` keeps only the (path, method) pairs the same-origin relay forwards
+ * (`RELAY_ROUTES`, lib/relay.ts) — an agent reading it never learns the hub's
+ * host, and never calls a path this site would answer 404.
  */
 
+import { browserApiOrigin } from "../../lib/api-origin.generated";
+import { RELAY_ROUTES } from "../../lib/relay";
+import { TOPOLOGY } from "../../lib/topology.generated";
+import { resolveBaseUrl } from "../../src/lib/routes";
+
 // Read per request: the document is the running API's, and `next build` has
 // no API to read it from.
 export const dynamic = "force-dynamic";
@@ -33,9 +44,7 @@ const LOCAL_API_ORIGIN = "http://localhost:3001";
  */
 function apiBase(): string {
   return stripSlash(
-    process.env["AILK_API_URL"] ||
-      process.env["NEXT_PUBLIC_AILK_API_URL"] ||
-      LOCAL_API_ORIGIN,
+    process.env["AILK_API_URL"] || browserApiOrigin() || LOCAL_API_ORIGIN,
   );
 }
 
@@ -45,9 +54,7 @@ function apiBase(): string {
  */
 function publicApiBase(): string {
   return stripSlash(
-    process.env["NEXT_PUBLIC_AILK_API_URL"] ||
-      process.env["AILK_API_URL"] ||
-      LOCAL_API_ORIGIN,
+    browserApiOrigin() || process.env["AILK_API_URL"] || LOCAL_API_ORIGIN,
   );
 }
 
@@ -58,6 +65,7 @@ function stripSlash(url: string): string {
 interface OpenApiDocument {
   openapi: string;
   servers?: Array<{ url?: unknown; description?: unknown }>;
+  paths?: Record<string, unknown>;
 }
 
 function isOpenApiDocument(value: unknown): value is OpenApiDocument {
@@ -86,6 +94,61 @@ function withAbsoluteServers(spec: OpenApiDocument): OpenApiDocument {
   };
 }
 
+/** The operation keys an OpenAPI path item may carry (OpenAPI 3.1 § 4.8.9). */
+const OPERATION_KEYS = new Set([
+  "get",
+  "put",
+  "post",
+  "delete",
+  "options",
+  "head",
+  "patch",
+  "trace",
+]);
+
+/**
+ * The document as a spoke serves it (#7426 D12): this host's own origin as
+ * the only server, and only the relayed (path, method) pairs. A path item's
+ * non-operation keys (`summary`, `parameters`, ...) ride along with a kept
+ * operation; a `servers` list — on the path item or on a kept operation —
+ * never does: it would name the hub.
+ */
+function withoutServers(operation: unknown): unknown {
+  if (typeof operation !== "object" || operation === null) return operation;
+  const { servers: _servers, ...rest } = operation as Record<string, unknown>;
+  return rest;
+}
+
+function asSpokeDocument(spec: OpenApiDocument): OpenApiDocument {
+  const relayed = new Map<string, Set<string>>();
+  for (const { method, path } of RELAY_ROUTES) {
+    const methods = relayed.get(path) ?? new Set<string>();
+    methods.add(method.toLowerCase());
+    relayed.set(path, methods);
+  }
+  const paths: Record<string, unknown> = {};
+  for (const [path, item] of Object.entries(spec.paths ?? {})) {
+    const methods = relayed.get(path);
+    if (methods === undefined || typeof item !== "object" || item === null) {
+      continue;
+    }
+    const kept = Object.fromEntries(
+      Object.entries(item)
+        .filter(([key]) =>
+          OPERATION_KEYS.has(key) ? methods.has(key) : key !== "servers",
+        )
+        .map(([key, value]) => [
+          key,
+          OPERATION_KEYS.has(key) ? withoutServers(value) : value,
+        ]),
+    );
+    if (Object.keys(kept).some((key) => OPERATION_KEYS.has(key))) {
+      paths[path] = kept;
+    }
+  }
+  return { ...spec, servers: [{ url: stripSlash(resolveBaseUrl()) }], paths };
+}
+
 function badGateway(message: string): Response {
   return Response.json(
     { error: { code: "upstream_unavailable", message } },
@@ -120,7 +183,9 @@ export async function GET(): Promise<Response> {
     return badGateway("The API answered JSON that is not an OpenAPI document.");
   }
 
-  return Response.json(withAbsoluteServers(spec), {
+  const served =
+    TOPOLOGY === "spoke" ? asSpokeDocument(spec) : withAbsoluteServers(spec);
+  return Response.json(served, {
     status: 200,
     headers: { "cache-control": "public, max-age=3600" },
   });

package/templates/apps/web/auth.ts

@@ -134,13 +134,16 @@ function deferredPrismaForAuth(): PrismaClient {
 }
 
 /**
- * The one delegate method `onPasswordReset` reaches for, named so the call
+ * The two delegate methods `onPasswordReset` reaches for, named so the call
  * site needs no cast. Method shorthand for the same reason `AuthEmailPrisma`
  * uses it: the generated `PrismaClient` satisfies this structurally, and
- * nothing wider than `verification.deleteMany` is reachable through it.
+ * nothing wider than `verification.deleteMany` and
+ * `oAuthAuthorization.updateMany` is reachable through it. The second ends
+ * every credential a spoke holds for the person (#7894 D4, SEC-7894-5).
  */
 interface VerificationStore {
   verification: { deleteMany(args: unknown): Promise<unknown> };
+  oAuthAuthorization: { updateMany(args: unknown): Promise<unknown> };
 }
 
 type SocialProviders = {
@@ -364,6 +367,30 @@ export function createAuth(deps: CreateAuthDeps = {}) {
         })}`,
       );
     }
+    /**
+     * A completed reset also ends every credential a SPOKE holds for this
+     * person (#7894 D4, SEC-7894-5). A hub session an attacker held minted
+     * spoke credentials of its own; recovering the account must end those too,
+     * or the attacker keeps reading the person's data on every spoke for the
+     * rest of the credential's 24 hours. The same posture as the sibling
+     * delete above: the reset ALREADY SUCCEEDED, so a failed revoke is
+     * logged (the user id and a reason, never a credential) and never turns
+     * it into a 500.
+     */
+    try {
+      await verificationStore.oAuthAuthorization.updateMany({
+        where: { userId: user.id, revokedAt: null },
+        data: { revokedAt: new Date() },
+      });
+    } catch {
+      console.warn(
+        `[auth-email] ${JSON.stringify({
+          userId: user.id,
+          kind: "password-reset",
+          reason: "spoke_credential_revocation_failed",
+        })}`,
+      );
+    }
     /**
      * Guarded like its sibling above, though `lib/auth-email.ts` now also
      * guards its own signing step (#6068). BOTH, deliberately: this callback

package/templates/apps/web/components/sign-out-trigger.tsx

@@ -3,6 +3,11 @@
 /**
  * SignOutTrigger — wraps the signed-in Nav's "Sign out" trigger (#4984).
  *
+ * With an `endpoint` (a spoke that signs in through its hub, #7894 D10) it
+ * POSTs there — the hub-session sign-out, which revokes the credential and
+ * clears the session cookie — and navigates home only when that succeeded;
+ * without one it calls Better Auth's client exactly as before.
+ *
  * The locale layout (RSC) reads the session and authors the "Sign out" nav
  * action as `kind: "flow"`; Nav hands the rendered trigger `<Button>` back
  * through `renderFlowTrigger` — composed in `SignedInNav`, on the client side
@@ -22,16 +27,30 @@ export interface SignOutTriggerProps {
   children: ReactNode;
   /** Where to land after signing out. Defaults to the site home. */
   homeHref?: string;
+  /** A same-origin sign-out route to POST to instead of Better Auth's client. */
+  endpoint?: string;
 }
 
 export function SignOutTrigger({
   children,
   homeHref = "/",
+  endpoint,
 }: SignOutTriggerProps): ReactElement {
   const router = useRouter();
 
   const handleSignOut = async (): Promise<void> => {
-    await authClient.signOut();
+    if (endpoint !== undefined) {
+      // A refused or failed sign-out leaves the visitor signed in, so the
+      // page must not pretend otherwise by navigating away.
+      try {
+        const res = await fetch(endpoint, { method: "POST", credentials: "same-origin" });
+        if (!res.ok) return;
+      } catch {
+        return;
+      }
+    } else {
+      await authClient.signOut();
+    }
     router.push(homeHref);
     router.refresh();
   };

package/templates/apps/web/components/signed-in-nav.tsx

@@ -32,9 +32,19 @@ import { SignOutTrigger } from "./sign-out-trigger";
 export type SignedInNavProps = Omit<
   NavProps,
   "navItems" | "renderFlowTrigger" | "translate" | "onSearchOpen"
->;
+> & {
+  /**
+   * Where "Sign out" POSTs, from the generated seam's `SIGN_OUT_ENDPOINT`
+   * (#7894 D10) — a spoke that signs in through its hub. Absent or `null`,
+   * Sign out goes through Better Auth's client, as on a hub.
+   */
+  signOutEndpoint?: string | null;
+};
 
-export function SignedInNav(props: SignedInNavProps): ReactElement {
+export function SignedInNav({
+  signOutEndpoint,
+  ...props
+}: SignedInNavProps): ReactElement {
   return (
     <Nav
       {...props}
@@ -43,7 +53,11 @@ export function SignedInNav(props: SignedInNavProps): ReactElement {
       // SignOutTrigger, the account action a non-navigating name label.
       renderFlowTrigger={(action, trigger) =>
         action.labelKey === "signOut" ? (
-          <SignOutTrigger>{trigger}</SignOutTrigger>
+          <SignOutTrigger
+            {...(signOutEndpoint ? { endpoint: signOutEndpoint } : {})}
+          >
+            {trigger}
+          </SignOutTrigger>
         ) : (
           <span
             className="text-body-sm text-(--color-text-muted)"

package/templates/apps/web/instrumentation.ts

@@ -2,13 +2,16 @@
  * Next.js instrumentation hook — runs once per server instance at boot.
  *
  * Registers the durable home of a renewed licence key (#6677 DD-6) before any
- * request resolves the licence. Node runtime only: the store reaches the
- * database through Prisma, which the Edge runtime cannot load.
+ * request resolves the licence, through the generated topology seam (#7426
+ * D5): a hub registers the database-backed store; a spoke has no database,
+ * so its render registers nothing. Node runtime only: the store reaches the
+ * database through Prisma, which the Edge runtime cannot load — the import
+ * stays inside the runtime check so the Edge bundle never carries it.
  */
 
 export async function register(): Promise<void> {
   if (process.env.NEXT_RUNTIME === "nodejs") {
-    const { registerLicenseKeyStore } = await import("./lib/license-key-store");
-    await registerLicenseKeyStore();
+    const { registerSiteStores } = await import("./lib/topology.generated");
+    await registerSiteStores();
   }
 }

package/templates/apps/web/lib/__tests__/account-config.test.ts

@@ -107,10 +107,12 @@ describe("account-config exports (AC-6)", () => {
     expect(Array.isArray(accountForYouSources)).toBe(true);
   });
 
-  it("ships exactly the two base Inbox kinds, both Recents rows (D6a, D9)", () => {
+  it("ships exactly the base Inbox kinds and the member kinds (#7920), all Recents rows (D6a, D9)", () => {
     expect(accountInboxKinds.map((k) => [k.kind, k.section])).toEqual([
       ["result", "updates"],
       ["purchase", "updates"],
+      ["piece", "updates"],
+      ["message", "updates"],
     ]);
     // Nothing in the base area fills Scheduled (the old Upcoming), and no
     // Inbox row asks for a decision — that is the For-you panel's job.
@@ -118,10 +120,11 @@ describe("account-config exports (AC-6)", () => {
     expect(accountInboxKinds.some((k) => k.section === "needs-you")).toBe(false);
   });
 
-  it("ships email-unverified and payment-due as For-you sources, not Inbox kinds (D9 as amended)", () => {
+  it("ships email-unverified, payment-due and piece-needs-client (#7920) as For-you sources, not Inbox kinds (D9 as amended)", () => {
     expect(accountForYouSources.map((s) => s.id)).toEqual([
       "email-unverified",
       "payment-due",
+      "piece-needs-client",
     ]);
     const kinds = accountInboxKinds.map((k) => k.kind);
     expect(kinds).not.toContain("email-unverified");

package/templates/apps/web/lib/__tests__/closing-footer-path.test.ts

@@ -0,0 +1,96 @@
+import {
+  isClosingFooterPath,
+  normalizeRoutePath,
+} from "../closing-footer-path";
+
+const LOCALES = ["en", "es"];
+
+describe("normalizeRoutePath (#7797)", () => {
+  it.each([
+    ["/about", "/about"],
+    ["/about/", "/about"],
+    ["/about//", "/about"],
+    ["/es/about", "/about"],
+    ["/es/about/", "/about"],
+    ["/about?x=1", "/about"],
+    ["/about#team", "/about"],
+    ["/services/first-engagement/", "/services/first-engagement"],
+    ["/", "/"],
+    ["", "/"],
+    ["/es", "/"],
+    ["/es/", "/"],
+  ])("%s → %s", (input, expected) => {
+    expect(normalizeRoutePath(input, LOCALES)).toBe(expected);
+  });
+
+  it("strips only a whole leading locale segment", () => {
+    expect(normalizeRoutePath("/espresso", LOCALES)).toBe("/espresso");
+    expect(normalizeRoutePath("/about/es", LOCALES)).toBe("/about/es");
+  });
+
+  it("strips no prefix when no locale is enabled", () => {
+    expect(normalizeRoutePath("/es/about", [])).toBe("/es/about");
+  });
+});
+
+describe("isClosingFooterPath (#7797)", () => {
+  const paths = ["/about", "/services/first-engagement/"];
+
+  it.each([
+    "/about",
+    "/about/",
+    "/es/about",
+    "/es/about/",
+    "/services/first-engagement",
+  ])("%s is a listed page", (pathname) => {
+    expect(isClosingFooterPath({ pathname, paths, locales: LOCALES })).toBe(
+      true,
+    );
+  });
+
+  it.each(["/services", "/about/team", "/aboutus", "/privacy", "/es/contact"])(
+    "%s is not a listed page",
+    (pathname) => {
+      expect(isClosingFooterPath({ pathname, paths, locales: LOCALES })).toBe(
+        false,
+      );
+    },
+  );
+
+  it("matches a listed path spelled with a locale prefix or a trailing slash", () => {
+    expect(
+      isClosingFooterPath({
+        pathname: "/about",
+        paths: ["/es/about/"],
+        locales: LOCALES,
+      }),
+    ).toBe(true);
+  });
+
+  it("is false with no list, an empty list, or no pathname", () => {
+    expect(
+      isClosingFooterPath({
+        pathname: "/about",
+        paths: undefined,
+        locales: LOCALES,
+      }),
+    ).toBe(false);
+    expect(
+      isClosingFooterPath({ pathname: "/about", paths: [], locales: LOCALES }),
+    ).toBe(false);
+    expect(
+      isClosingFooterPath({ pathname: null, paths, locales: LOCALES }),
+    ).toBe(false);
+    expect(isClosingFooterPath({ pathname: "", paths, locales: LOCALES })).toBe(
+      false,
+    );
+  });
+
+  it("never selects the home, even when it is listed", () => {
+    for (const pathname of ["/", "/es", "/es/"]) {
+      expect(
+        isClosingFooterPath({ pathname, paths: ["/"], locales: LOCALES }),
+      ).toBe(false);
+    }
+  });
+});