create-ailk 0.19.1 → 0.21.0

package/templates/apps/web/app/[locale]/unsubscribe/__tests__/unsubscribe.test.tsx

@@ -0,0 +1,158 @@
+/**
+ * Tests for /[locale]/unsubscribe (#8438 D17, AC-3 unsubscribe).
+ */
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+
+/**
+ * One interpolating translator for both halves of the page: the server half
+ * (`getTranslations`, the heading and lead) and the client island
+ * (`useTranslations`, whose done line formats `{description}` in). The
+ * workspace's mapped `next-intl` stub ignores ICU values, so it is replaced
+ * here, the way this file already replaces `next-intl/server`.
+ */
+function mockTranslator(ns: string): (key: string, values?: Record<string, unknown>) => string {
+  const msgs: unknown = require("../../../../messages/en.json");
+  const dig = (obj: unknown, path: string): unknown =>
+    path.split(".").reduce<unknown>(
+      (acc, k) => (acc !== null && typeof acc === "object" ? (acc as Record<string, unknown>)[k] : undefined),
+      obj,
+    );
+  const messages = dig(msgs, ns);
+  return (key, values) => {
+    const value = dig(messages, key);
+    if (typeof value !== "string") return `${ns}.${key}`;
+    return value.replace(/\{(\w+)\}/g, (m, name: string) =>
+      values && name in values ? String(values[name]) : m,
+    );
+  };
+}
+
+jest.mock("next-intl/server", () => ({
+  __esModule: true,
+  getTranslations: async (arg: string | { namespace?: string; locale?: string }) =>
+    mockTranslator(typeof arg === "string" ? arg : (arg.namespace ?? "")),
+}));
+
+jest.mock("next-intl", () => ({
+  __esModule: true,
+  useTranslations: (ns: string) => mockTranslator(ns),
+}));
+
+const mockUnsubscribe = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  consent: { unsubscribe: (...args: unknown[]) => mockUnsubscribe(...args) },
+  visitorForwardHeaders: () => undefined,
+}));
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue(new Headers()),
+}));
+
+import Page, { generateMetadata } from "../page";
+
+const ok = <T,>(body: T) => ({ ok: true, body });
+const refusal = (status: number) => ({ ok: false, status, body: null });
+
+beforeEach(() => {
+  mockUnsubscribe.mockReset();
+});
+
+async function renderPage(token: string | undefined): Promise<void> {
+  render(
+    await Page({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve(token === undefined ? {} : { t: token }),
+    }),
+  );
+}
+
+describe("metadata — noindex, no-referrer (D17, SEC-8438-9)", () => {
+  it("is noindex and sends no-referrer", async () => {
+    const meta = await generateMetadata({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve({}),
+    });
+    expect(meta.robots).toEqual({ index: false, follow: true });
+    expect(meta.referrer).toBe("no-referrer");
+  });
+});
+
+describe("the page performs no write on GET", () => {
+  it("renders with no call to unsubscribeAction", async () => {
+    await renderPage("tok_1");
+    expect(mockUnsubscribe).not.toHaveBeenCalled();
+    expect(screen.getByTestId("unsubscribe-page")).toBeInTheDocument();
+    expect(screen.getByRole("heading", { level: 1 })).toHaveTextContent("Unsubscribe");
+    expect(screen.getByText("Stop these emails?")).toBeInTheDocument();
+  });
+});
+
+describe("with no token", () => {
+  it("shows the invalid-link line and no button", async () => {
+    await renderPage(undefined);
+    expect(screen.getByTestId("unsubscribe-invalid")).toHaveTextContent("This link isn't valid.");
+    expect(screen.queryByTestId("unsubscribe-button")).not.toBeInTheDocument();
+    expect(mockUnsubscribe).not.toHaveBeenCalled();
+  });
+});
+
+describe("clicking Unsubscribe", () => {
+  it("a changed answer shows the done line with the purpose's description", async () => {
+    mockUnsubscribe.mockResolvedValue(
+      ok({ purpose: { id: "marketing_email", description: "product news and offers" }, changed: true }),
+    );
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(mockUnsubscribe).toHaveBeenCalledWith({ token: "tok_1" });
+    expect(await screen.findByTestId("unsubscribe-done")).toHaveTextContent(
+      "You're unsubscribed from product news and offers.",
+    );
+  });
+
+  it("changed: false shows the already-unsubscribed line, with no second write implied", async () => {
+    mockUnsubscribe.mockResolvedValue(
+      ok({ purpose: { id: "marketing_email", description: "product news and offers" }, changed: false }),
+    );
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(await screen.findByTestId("unsubscribe-already")).toHaveTextContent(
+      "You were already unsubscribed.",
+    );
+  });
+
+  it("any 400 shows the invalid-link line", async () => {
+    mockUnsubscribe.mockResolvedValue(refusal(400));
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(await screen.findByTestId("unsubscribe-invalid")).toHaveTextContent("This link isn't valid.");
+  });
+
+  it("a 429 (rate-limited) shows the unavailable line, never the invalid-link line", async () => {
+    mockUnsubscribe.mockResolvedValue(refusal(429));
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(await screen.findByTestId("unsubscribe-unavailable")).toHaveTextContent(
+      "Unsubscribing isn't available right now.",
+    );
+    expect(screen.queryByTestId("unsubscribe-invalid")).not.toBeInTheDocument();
+  });
+
+  it("a 5xx shows the unavailable line", async () => {
+    mockUnsubscribe.mockResolvedValue(refusal(503));
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(await screen.findByTestId("unsubscribe-unavailable")).toHaveTextContent(
+      "Unsubscribing isn't available right now.",
+    );
+  });
+
+  it("a thrown error shows the unavailable line, never a crash", async () => {
+    mockUnsubscribe.mockRejectedValue(new TypeError("fetch failed"));
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(await screen.findByTestId("unsubscribe-unavailable")).toBeInTheDocument();
+  });
+});

package/templates/apps/web/app/[locale]/unsubscribe/page.tsx

@@ -0,0 +1,54 @@
+/**
+ * /[locale]/unsubscribe — the one unsubscribe landing every signed link
+ * calls (#8438 D17, NEW). Public, `noindex`, `referrer: no-referrer` so the
+ * `?t=` token never leaks through a Referer header off this page (D17,
+ * SEC-8438-9).
+ *
+ * RSC: reads `?t=` and renders the heading, the lead and the one
+ * interactive piece (`UnsubscribeButton`, "use client") that posts
+ * `unsubscribeAction(token)` ON CLICK — never on this GET, so a mail
+ * scanner's prefetch writes nothing. The island gets the token and nothing
+ * else: it reads its own strings, because anything callable handed across
+ * this server→client edge fails Flight serialization (the scaffold matrix's
+ * `GET /unsubscribe -> 500`; `__tests__/unsubscribe-rsc-boundary.test.tsx`).
+ */
+
+import { Heading, Text } from "@working-theory/ui/primitives";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { UnsubscribeButton } from "./unsubscribe-button";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  searchParams: Promise<{ t?: string }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "unsubscribe" });
+  return {
+    title: t("title"),
+    robots: { index: false, follow: true },
+    referrer: "no-referrer",
+  };
+}
+
+export default async function UnsubscribePage({ params, searchParams }: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  const { t: token } = await searchParams;
+  const t = await getTranslations({ locale, namespace: "unsubscribe" });
+
+  return (
+    <div className="mx-auto flex max-w-md flex-col gap-4 px-4 py-16" data-testid="unsubscribe-page">
+      <Heading level={1} visual={2}>
+        {t("title")}
+      </Heading>
+      <Text as="p" variant="body">
+        {t("lead")}
+      </Text>
+      <UnsubscribeButton token={token ?? null} />
+    </div>
+  );
+}

package/templates/apps/web/app/[locale]/unsubscribe/unsubscribe-button.tsx

@@ -0,0 +1,73 @@
+"use client"; // owns the click → unsubscribeAction → result state
+
+/**
+ * UnsubscribeButton — the unsubscribe page's one interactive piece (#8438
+ * D17). Posts `unsubscribeAction(token)` on click only — never on render,
+ * so a mail scanner's GET prefetch of the page writes nothing.
+ *
+ * Reads its own strings through `useTranslations` (the island idiom
+ * `FlowStepperClient` uses) rather than taking them as props: the done line
+ * needs the purpose's description formatted in, and a formatting FUNCTION
+ * handed across from the page (a Server Component) cannot be serialized
+ * into the Flight payload — the scaffold matrix's `GET /unsubscribe -> 500`
+ * (`unsubscribe-rsc-boundary.test.tsx` holds the regression).
+ */
+
+import { Button, InlineMessage } from "@working-theory/ui/primitives";
+import { useTranslations } from "next-intl";
+import { useState, useTransition, type ReactElement } from "react";
+
+import { unsubscribeAction, type UnsubscribeResult } from "./unsubscribe.actions";
+
+export function UnsubscribeButton({ token }: { token: string | null }): ReactElement {
+  const t = useTranslations("unsubscribe");
+  const [result, setResult] = useState<UnsubscribeResult | null>(null);
+  const [pending, startTransition] = useTransition();
+
+  if (token === null || result?.kind === "invalid") {
+    return (
+      <InlineMessage variant="error" role="alert" data-testid="unsubscribe-invalid">
+        {t("invalid")}
+      </InlineMessage>
+    );
+  }
+
+  if (result?.kind === "done") {
+    return (
+      <InlineMessage variant="success" role="status" data-testid="unsubscribe-done">
+        {t("done", { description: result.description })}
+      </InlineMessage>
+    );
+  }
+
+  if (result?.kind === "already") {
+    return (
+      <InlineMessage variant="success" role="status" data-testid="unsubscribe-already">
+        {t("already")}
+      </InlineMessage>
+    );
+  }
+
+  if (result?.kind === "unavailable") {
+    return (
+      <InlineMessage variant="error" role="alert" data-testid="unsubscribe-unavailable">
+        {t("unavailable")}
+      </InlineMessage>
+    );
+  }
+
+  return (
+    <Button
+      type="button"
+      disabled={pending}
+      onClick={() => {
+        startTransition(async () => {
+          setResult(await unsubscribeAction(token));
+        });
+      }}
+      data-testid="unsubscribe-button"
+    >
+      {t("button")}
+    </Button>
+  );
+}

package/templates/apps/web/app/[locale]/unsubscribe/unsubscribe.actions.ts

@@ -0,0 +1,55 @@
+"use server";
+
+/**
+ * unsubscribeAction — the unsubscribe page's one write (#8438 D9, D17).
+ *
+ * Calls `POST /v1/consent/unsubscribe` (`consent.unsubscribe`) through
+ * `@working-theory/api-client`, carrying the visitor-forward headers a
+ * spoke attaches today — the same idiom `contact.actions.ts` uses. Never
+ * writes anything on its own: the page's GET never calls this, so a mail
+ * scanner's prefetch of the link changes nothing (D17).
+ *
+ * The token is the only authority (D9) — this action never names an email,
+ * a workspace or a person.
+ */
+
+import { consent, visitorForwardHeaders } from "@working-theory/api-client";
+import { headers } from "next/headers";
+
+export type UnsubscribeResult =
+  | { kind: "done"; description: string }
+  | { kind: "already" }
+  | { kind: "invalid" }
+  | { kind: "unavailable" };
+
+export async function unsubscribeAction(token: string): Promise<UnsubscribeResult> {
+  let init: { headers: Record<string, string> } | undefined;
+  try {
+    const forwarded = visitorForwardHeaders(
+      await headers(),
+      process.env.AILK_VISITOR_FORWARD_KEY,
+    );
+    if (forwarded) init = { headers: forwarded };
+  } catch {
+    // No request scope to read — call with no forwarding.
+  }
+
+  try {
+    const res = init
+      ? await consent.unsubscribe({ token }, init)
+      : await consent.unsubscribe({ token });
+    if (!res.ok) {
+      // 429 is transient (a rate limit), never the token's fault — "invalid"
+      // would tell a visitor the link itself is bad when retrying would work.
+      if (res.status >= 400 && res.status < 500 && res.status !== 429) return { kind: "invalid" };
+      return { kind: "unavailable" };
+    }
+    if (!res.body.changed) return { kind: "already" };
+    return { kind: "done", description: res.body.purpose.description };
+  } catch (err) {
+    // The api-client never attaches the request payload to a thrown error,
+    // so logging `err` carries no token.
+    console.error("[unsubscribeAction]", err);
+    return { kind: "unavailable" };
+  }
+}

package/templates/apps/web/app/[locale]/whitepapers/__tests__/page-renderer-migration.test.tsx

@@ -62,7 +62,7 @@ describe("whitepapers/[slug] — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(`
-     "<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@graph":[{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"AILK AEO Strategy 2026","description":"In-depth research on answer engine optimization for AILK products.","mainEntity":{"@context":"https://schema.org","@type":"Article","headline":"AILK AEO Strategy 2026","description":"In-depth research on answer engine optimization for AILK products."}},{"@context":"https://schema.org","@type":"BreadcrumbList","inLanguage":"en","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http://localhost:3000/en/"},{"@type":"ListItem","position":2,"name":"Whitepapers","item":"http://localhost:3000/en/whitepapers"},{"@type":"ListItem","position":3,"name":"AILK AEO Strategy 2026","item":"http://localhost:3000/en/whitepapers/ailk-aeo-strategy-2026"}]}]}</script><main id="main"><div class="mx-auto w-full max-w-container-xl px-4 md:px-6 lg:px-8 py-section"><h1 class="text-heading-1 lg:text-display-sm font-display text-fg hero-type-display">AILK AEO Strategy 2026</h1><p data-testid="whitepaper-description" class="mt-block-tight text-lead">In-depth research on answer engine optimization for AILK products.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle mt-block-loose"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div class="ailk-prose max-w-none text-(--color-fg) text-body-sm leading-relaxed [&amp;>*:first-child]:mt-0 [&amp;_h2]:mt-block-loose [&amp;_h2]:scroll-mt-24 [&amp;_h2]:text-heading-3 [&amp;_h2]:font-display [&amp;_h2]:text-(--color-fg) [&amp;_h3]:mt-block-loose [&amp;_h3]:scroll-mt-24 [&amp;_h3]:text-heading-4 [&amp;_h3]:font-display [&amp;_h3]:text-(--color-fg) [&amp;_h4]:mt-block-tight [&amp;_h4]:scroll-mt-24 [&amp;_h4]:text-heading-4 [&amp;_h4]:font-display [&amp;_h4]:text-(--color-fg) [&amp;_h5]:mt-block-tight [&amp;_h5]:scroll-mt-24 [&amp;_h5]:text-heading-4 [&amp;_h5]:font-display [&amp;_h5]:text-(--color-fg) [&amp;_h6]:mt-block-tight [&amp;_h6]:scroll-mt-24 [&amp;_h6]:text-heading-4 [&amp;_h6]:font-display [&amp;_h6]:text-(--color-fg) [&amp;_p]:mt-paragraph [&amp;_strong]:font-semibold [&amp;_strong]:text-(--color-fg) [&amp;_em]:italic [&amp;_ul]:mt-paragraph [&amp;_ul]:list-disc [&amp;_ul]:ps-6 [&amp;_ol]:mt-paragraph [&amp;_ol]:list-decimal [&amp;_ol]:ps-6 [&amp;_li]:mt-1 [&amp;_li]:ps-1 [&amp;_li]:marker:text-(--color-text-muted) [&amp;_li>ul]:mt-1 [&amp;_li>ol]:mt-1 [&amp;_blockquote]:mt-paragraph [&amp;_blockquote]:border-s-4 [&amp;_blockquote]:border-(--color-border-strong) [&amp;_blockquote]:ps-4 [&amp;_blockquote]:italic [&amp;_blockquote]:text-(--color-text-muted) [&amp;_hr]:my-block-loose [&amp;_hr]:border-(--color-border) [&amp;_a]:text-(--color-accent) [&amp;_a]:underline [&amp;_a]:underline-offset-4 [&amp;_:not(pre)>code]:rounded [&amp;_:not(pre)>code]:bg-(--color-surface-secondary) [&amp;_:not(pre)>code]:px-1.5 [&amp;_:not(pre)>code]:py-0.5 [&amp;_:not(pre)>code]:text-code [&amp;_:not(pre)>code]:font-mono [&amp;_:not(pre)>code]:text-(--color-fg) [&amp;_pre]:mt-paragraph [&amp;_pre]:overflow-auto [&amp;_pre]:rounded-md [&amp;_pre]:border-hairline [&amp;_pre]:border-(--color-border) [&amp;_pre]:bg-(--color-bg) [&amp;_pre]:p-4 [&amp;_pre]:font-mono [&amp;_pre]:text-body-sm [&amp;_img]:mt-paragraph [&amp;_img]:h-auto [&amp;_img]:max-w-full [&amp;_img]:rounded-lg [&amp;_table]:mt-paragraph [&amp;_table]:w-full [&amp;_table]:border-collapse [&amp;_table]:text-body-sm [&amp;_th]:border-b [&amp;_th]:border-(--color-border) [&amp;_th]:bg-(--color-surface-secondary) [&amp;_th]:px-3 [&amp;_th]:py-2 [&amp;_th]:text-start [&amp;_th]:font-semibold [&amp;_th]:text-(--color-fg) [&amp;_td]:border-b [&amp;_td]:border-(--color-border) [&amp;_td]:px-3 [&amp;_td]:py-2 [&amp;_kbd]:rounded [&amp;_kbd]:border-hairline [&amp;_kbd]:border-(--color-border) [&amp;_kbd]:bg-(--color-surface-secondary) [&amp;_kbd]:px-1.5 [&amp;_kbd]:py-0.5 [&amp;_kbd]:text-caption [&amp;_kbd]:font-mono" data-testid="mdx-content"><div data-testid="mdx-rendered">## Executive Summary
+     "<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@graph":[{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"AILK AEO Strategy 2026","description":"In-depth research on answer engine optimization for AILK products.","mainEntity":{"@context":"https://schema.org","@type":"Article","headline":"AILK AEO Strategy 2026","description":"In-depth research on answer engine optimization for AILK products."}},{"@context":"https://schema.org","@type":"BreadcrumbList","inLanguage":"en","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http://localhost:3000/en/"},{"@type":"ListItem","position":2,"name":"Whitepapers","item":"http://localhost:3000/en/whitepapers"},{"@type":"ListItem","position":3,"name":"AILK AEO Strategy 2026","item":"http://localhost:3000/en/whitepapers/ailk-aeo-strategy-2026"}]}]}</script><main id="main"><div class="mx-auto w-full max-w-container-xl px-4 md:px-6 lg:px-8 py-section"><h1 class="text-heading-1 lg:text-display-sm font-display text-fg hero-type-display">AILK AEO Strategy 2026</h1><p data-testid="whitepaper-description" class="mt-block-tight text-lead">In-depth research on answer engine optimization for AILK products.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle mt-block-loose"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div class="ailk-prose max-w-none text-(--color-text-muted) text-body-sm leading-relaxed [&amp;>*:first-child]:mt-0 [&amp;_h2]:mt-block-loose [&amp;_h2]:scroll-mt-24 [&amp;_h2]:text-heading-3 [&amp;_h2]:font-display [&amp;_h2]:text-(--color-fg) [&amp;_h3]:mt-block-loose [&amp;_h3]:scroll-mt-24 [&amp;_h3]:text-heading-4 [&amp;_h3]:font-display [&amp;_h3]:text-(--color-fg) [&amp;_h4]:mt-block-tight [&amp;_h4]:scroll-mt-24 [&amp;_h4]:text-heading-4 [&amp;_h4]:font-display [&amp;_h4]:text-(--color-fg) [&amp;_h5]:mt-block-tight [&amp;_h5]:scroll-mt-24 [&amp;_h5]:text-heading-4 [&amp;_h5]:font-display [&amp;_h5]:text-(--color-fg) [&amp;_h6]:mt-block-tight [&amp;_h6]:scroll-mt-24 [&amp;_h6]:text-heading-4 [&amp;_h6]:font-display [&amp;_h6]:text-(--color-fg) [&amp;_p]:mt-paragraph [&amp;_strong]:font-semibold [&amp;_strong]:text-(--color-fg) [&amp;_em]:italic [&amp;_ul]:mt-paragraph [&amp;_ul]:list-disc [&amp;_ul]:ps-6 [&amp;_ol]:mt-paragraph [&amp;_ol]:list-decimal [&amp;_ol]:ps-6 [&amp;_li]:mt-1 [&amp;_li]:ps-1 [&amp;_li]:marker:text-(--color-text-muted) [&amp;_li>ul]:mt-1 [&amp;_li>ol]:mt-1 [&amp;_blockquote]:mt-paragraph [&amp;_blockquote]:border-s-4 [&amp;_blockquote]:border-(--color-border-strong) [&amp;_blockquote]:ps-4 [&amp;_blockquote]:italic [&amp;_blockquote]:text-(--color-text-muted) [&amp;_hr]:my-block-loose [&amp;_hr]:border-(--color-border) [&amp;_a]:text-(--color-accent) [&amp;_a]:underline [&amp;_a]:underline-offset-4 [&amp;_:not(pre)>code]:rounded [&amp;_:not(pre)>code]:bg-(--color-surface-secondary) [&amp;_:not(pre)>code]:px-1.5 [&amp;_:not(pre)>code]:py-0.5 [&amp;_:not(pre)>code]:text-code [&amp;_:not(pre)>code]:font-mono [&amp;_:not(pre)>code]:text-(--color-fg) [&amp;_pre]:mt-paragraph [&amp;_pre]:overflow-auto [&amp;_pre]:rounded-md [&amp;_pre]:border-hairline [&amp;_pre]:border-(--color-border) [&amp;_pre]:bg-(--color-bg) [&amp;_pre]:p-4 [&amp;_pre]:font-mono [&amp;_pre]:text-body-sm [&amp;_img]:mt-paragraph [&amp;_img]:h-auto [&amp;_img]:max-w-full [&amp;_img]:rounded-lg [&amp;_table]:mt-paragraph [&amp;_table]:w-full [&amp;_table]:border-collapse [&amp;_table]:text-body-sm [&amp;_th]:border-b [&amp;_th]:border-(--color-border) [&amp;_th]:bg-(--color-surface-secondary) [&amp;_th]:px-3 [&amp;_th]:py-2 [&amp;_th]:text-start [&amp;_th]:font-semibold [&amp;_th]:text-(--color-fg) [&amp;_td]:border-b [&amp;_td]:border-(--color-border) [&amp;_td]:px-3 [&amp;_td]:py-2 [&amp;_kbd]:rounded [&amp;_kbd]:border-hairline [&amp;_kbd]:border-(--color-border) [&amp;_kbd]:bg-(--color-surface-secondary) [&amp;_kbd]:px-1.5 [&amp;_kbd]:py-0.5 [&amp;_kbd]:text-caption [&amp;_kbd]:font-mono" data-testid="mdx-content"><div data-testid="mdx-rendered">## Executive Summary
 
      Body content.</div></div></article></div></div></div></main>"
     `);

package/templates/apps/web/app/[locale]/working-agreement/__tests__/page.test.tsx

@@ -0,0 +1,63 @@
+/**
+ * Tests for /working-agreement (#8661 D10, AC-6) — the twin of /terms and
+ * /privacy, serving the registered `WorkingAgreementPage` type so the
+ * contact form's terms statement never links a 404.
+ *
+ * `renderPage`/`renderPageMetadata` are mocked at the
+ * `@working-theory/page-renderer` boundary (the /reports suite's shape); each
+ * assertion inspects the calls directly.
+ */
+
+const mockRenderPage = jest.fn(async (..._args: unknown[]) => "<rendered/>");
+const mockRenderPageMetadata = jest.fn((..._args: unknown[]) => undefined);
+
+jest.mock("@working-theory/page-renderer", () => ({
+  __esModule: true,
+  renderPage: (...args: unknown[]) => mockRenderPage(...args),
+  renderPageMetadata: (...args: unknown[]) => mockRenderPageMetadata(...args),
+  getMdxSource: jest.fn(),
+  getPageSections: jest.fn(),
+}));
+
+import WorkingAgreementPage, { generateMetadata } from "../page";
+
+beforeEach(() => jest.clearAllMocks());
+
+describe("WorkingAgreementPage", () => {
+  it("renders the WorkingAgreementPage type at slug working-agreement, in its own namespace", async () => {
+    await WorkingAgreementPage({ params: Promise.resolve({ locale: "en" }) });
+
+    expect(mockRenderPage).toHaveBeenCalledTimes(1);
+    expect(mockRenderPage).toHaveBeenCalledWith({
+      type: "WorkingAgreementPage",
+      slug: "working-agreement",
+      locale: "en",
+      translationsNamespace: "workingAgreement",
+    });
+  });
+
+  it("passes injected content loaders through", async () => {
+    const getMdxSource = jest.fn();
+    const getPageSections = jest.fn();
+
+    await WorkingAgreementPage({
+      params: Promise.resolve({ locale: "fr" }),
+      getMdxSource,
+      getPageSections,
+    });
+
+    expect(mockRenderPage).toHaveBeenCalledWith(
+      expect.objectContaining({ locale: "fr", getMdxSource, getPageSections }),
+    );
+  });
+
+  it("builds metadata from the same type and slug", async () => {
+    await generateMetadata({ params: Promise.resolve({ locale: "en" }) });
+
+    expect(mockRenderPageMetadata).toHaveBeenCalledWith({
+      type: "WorkingAgreementPage",
+      slug: "working-agreement",
+      locale: "en",
+    });
+  });
+});

package/templates/apps/web/app/[locale]/working-agreement/page.tsx

@@ -0,0 +1,41 @@
+// Working Agreement page (#8661 D10). The /working-agreement route for the registered
+// `WorkingAgreementPage` type: reads its MDX frontmatter, renders sections via
+// SectionRenderer, and emits a JSON-LD <script>.
+import type {
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections} from "@working-theory/page-renderer";
+import {
+  renderPage,
+  renderPageMetadata
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+}
+
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "WorkingAgreementPage", slug: "working-agreement", locale });
+}
+
+export default async function Page({
+  params,
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  return renderPage({
+    type: "WorkingAgreementPage",
+    slug: "working-agreement",
+    locale,
+    translationsNamespace: "workingAgreement",
+    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(getPageSections !== undefined && { getPageSections }),
+  });
+}

package/templates/apps/web/app/robots.txt/route.ts

@@ -8,28 +8,31 @@
  *     (comma-separated paths, e.g. "/admin/,/private/")
  *   - STEALTH=true disallows every path for every crawler — layer 1 of the
  *     three-layer stealth posture (#884, #7374); it subsumes any
- *     AILK_ROBOTS_DISALLOW paths
+ *     AILK_ROBOTS_DISALLOW paths and drops the Sitemap line, so a hidden
+ *     site advertises no URLs (#8519). STEALTH is read through the shared
+ *     parse (#8511), so 1, yes and on count too, and an unknown value throws.
  */
 
+import { parseStealth } from "@working-theory/web-i18n/stealth";
+
 import { resolveBaseUrl } from "../../src/lib/routes";
 
 export function GET(): Response {
   const baseUrl = resolveBaseUrl();
   const disallowEnv = process.env["AILK_ROBOTS_DISALLOW"] ?? "";
+  const stealth = parseStealth(process.env["STEALTH"]);
 
-  const disallowPaths =
-    process.env["STEALTH"] === "true"
-      ? ["/"]
-      : disallowEnv
-          .split(",")
-          .map((p) => p.trim())
-          .filter((p) => p.length > 0);
+  const disallowPaths = stealth
+    ? ["/"]
+    : disallowEnv
+        .split(",")
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0);
 
   const lines = [
     "User-agent: *",
     ...disallowPaths.map((p) => `Disallow: ${p}`),
-    "",
-    `Sitemap: ${baseUrl}/sitemap.xml`,
+    ...(stealth ? [] : ["", `Sitemap: ${baseUrl}/sitemap.xml`]),
   ];
 
   return new Response(lines.join("\n"), {

package/templates/apps/web/jest.config.cjs

@@ -2,6 +2,7 @@
 // but no Vitest is installed anywhere yet). JSDOM env so RTL can mount components.
 module.exports = {
   preset: "ts-jest",
+  globalSetup: require.resolve("../../tools/jest/pin-timezone.cjs"),
   testEnvironment: "jsdom",
   roots: [
     "<rootDir>/__tests__",
@@ -89,6 +90,9 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/site-config/dist/schema/index.js",
     "^@working-theory/validation$": "<rootDir>/node_modules/@working-theory/validation/dist/index.js",
     "^@working-theory/web-i18n$": "<rootDir>/node_modules/@working-theory/web-i18n/dist/index.js",
+    // The Edge-safe `./stealth` subpath (#8511) → source, like the root entry.
+    "^@working-theory/web-i18n/stealth$":
+      "<rootDir>/node_modules/@working-theory/web-i18n/dist/stealth-metadata.js",
     // The dependency-free tenancy-constants subpath (database/tenancy.ts).
     // Mapped to source like every sibling above; `database/dist` is not
     // built in this workspace pre-`pnpm build`.