create-ailk 0.19.1 → 0.21.0

package/templates/apps/web/lib/__tests__/consent-visitor.test.ts

@@ -0,0 +1,163 @@
+/**
+ * Tests for consent-visitor.ts (the `ailk-vid` cookie helpers) and for
+ * `acceptCookiesAction`/`declineCookiesAction` (#8438 D12,
+ * `app/[locale]/consent.actions.ts`) — the banner's one write path.
+ */
+import {
+  consentVisitorHeader,
+  ensureConsentVisitor,
+  isValidConsentVisitorId,
+  readConsentVisitor,
+  readConsentVisitorFromCookieHeader,
+} from "../consent-visitor";
+
+const VALID_ID = "11111111-2222-4333-8444-555555555555";
+
+describe("isValidConsentVisitorId", () => {
+  it.each([VALID_ID, "aaaaaaaa-bbbb-4ccc-9ddd-eeeeeeeeeeee"])("%s is a valid v4 UUID", (id) => {
+    expect(isValidConsentVisitorId(id)).toBe(true);
+  });
+
+  it.each([
+    "",
+    "not-a-uuid",
+    "11111111-2222-3333-8444-555555555555", // version nibble is 3, not 4
+    "11111111-2222-4333-c444-555555555555", // variant nibble is c, not 8/9/a/b
+    `${VALID_ID} `,
+  ])("%j is not", (value) => {
+    expect(isValidConsentVisitorId(value)).toBe(false);
+  });
+});
+
+describe("readConsentVisitor", () => {
+  it("returns the cookie's value when it is a valid id", () => {
+    const cookies = { get: () => ({ value: VALID_ID }) };
+    expect(readConsentVisitor(cookies)).toBe(VALID_ID);
+  });
+
+  it("returns undefined with no cookie, or an invalid value", () => {
+    expect(readConsentVisitor({ get: () => undefined })).toBeUndefined();
+    expect(readConsentVisitor({ get: () => ({ value: "nope" }) })).toBeUndefined();
+  });
+});
+
+describe("ensureConsentVisitor", () => {
+  it("keeps an existing valid id and sets nothing", () => {
+    const set = jest.fn();
+    const cookies = { get: () => ({ value: VALID_ID }), set };
+    expect(ensureConsentVisitor(cookies)).toBe(VALID_ID);
+    expect(set).not.toHaveBeenCalled();
+  });
+
+  it("mints and sets a fresh v4 UUID when absent", () => {
+    const set = jest.fn();
+    const cookies = { get: () => undefined, set };
+    const id = ensureConsentVisitor(cookies);
+    expect(isValidConsentVisitorId(id)).toBe(true);
+    expect(set).toHaveBeenCalledTimes(1);
+    const [name, value, options] = set.mock.calls[0] as [string, string, Record<string, unknown>];
+    expect(name).toBe("ailk-vid");
+    expect(value).toBe(id);
+    expect(options).toMatchObject({ httpOnly: true, sameSite: "lax", path: "/" });
+  });
+
+  it("mints a fresh id when the stored value fails the UUID shape", () => {
+    const set = jest.fn();
+    const cookies = { get: () => ({ value: "garbage" }), set };
+    const id = ensureConsentVisitor(cookies);
+    expect(id).not.toBe("garbage");
+    expect(set).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("consentVisitorHeader", () => {
+  it("returns the one header, exactly", () => {
+    expect(consentVisitorHeader(VALID_ID)).toEqual({ "x-ailk-consent-visitor": VALID_ID });
+  });
+});
+
+describe("readConsentVisitorFromCookieHeader", () => {
+  it("reads the id out of a raw Cookie header", () => {
+    expect(readConsentVisitorFromCookieHeader(`ailk-vid=${VALID_ID}`)).toBe(VALID_ID);
+    expect(readConsentVisitorFromCookieHeader(`session=abc; ailk-vid=${VALID_ID}; other=1`)).toBe(VALID_ID);
+  });
+
+  it("returns undefined with no header, no matching cookie, or an invalid value", () => {
+    expect(readConsentVisitorFromCookieHeader(null)).toBeUndefined();
+    expect(readConsentVisitorFromCookieHeader(undefined)).toBeUndefined();
+    expect(readConsentVisitorFromCookieHeader("session=abc")).toBeUndefined();
+    expect(readConsentVisitorFromCookieHeader("ailk-vid=garbage")).toBeUndefined();
+  });
+});
+
+// ── acceptCookiesAction / declineCookiesAction (D12) ──────────────────────
+
+const mockRecordCookieChoice = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  consent: { recordCookieChoice: (...args: unknown[]) => mockRecordCookieChoice(...args) },
+  visitorForwardHeaders: () => undefined,
+}));
+
+const mockCookieGet = jest.fn();
+const mockCookieSet = jest.fn();
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  cookies: jest.fn().mockImplementation(async () => ({
+    get: (...args: unknown[]) => mockCookieGet(...args),
+    set: (...args: unknown[]) => mockCookieSet(...args),
+  })),
+  headers: jest.fn().mockResolvedValue(new Headers()),
+}));
+
+jest.mock("next-intl/server", () => ({
+  __esModule: true,
+  getLocale: jest.fn().mockResolvedValue("en"),
+}));
+
+describe("acceptCookiesAction / declineCookiesAction", () => {
+  beforeEach(() => {
+    mockRecordCookieChoice.mockReset().mockResolvedValue({ ok: true, body: { recorded: true } });
+    mockCookieGet.mockReset().mockReturnValue(undefined);
+    mockCookieSet.mockReset();
+  });
+
+  it("mints a visitor id when absent and calls recordCookieChoice once, accepted", async () => {
+    const { acceptCookiesAction } = await import("../../app/[locale]/consent.actions");
+    await acceptCookiesAction();
+    expect(mockCookieSet).toHaveBeenCalledTimes(1);
+    expect(mockRecordCookieChoice).toHaveBeenCalledTimes(1);
+    const [body] = mockRecordCookieChoice.mock.calls[0] as [{ visitorId: string; choice: string; locale: string }];
+    expect(isValidConsentVisitorId(body.visitorId)).toBe(true);
+    expect(body.choice).toBe("accepted");
+    expect(body.locale).toBe("en");
+  });
+
+  it("keeps an existing visitor id and declines", async () => {
+    mockCookieGet.mockReturnValue({ value: VALID_ID });
+    const { declineCookiesAction } = await import("../../app/[locale]/consent.actions");
+    await declineCookiesAction();
+    expect(mockCookieSet).not.toHaveBeenCalled();
+    const [body] = mockRecordCookieChoice.mock.calls[0] as [{ visitorId: string; choice: string }];
+    expect(body.visitorId).toBe(VALID_ID);
+    expect(body.choice).toBe("declined");
+  });
+
+  it("resolves even when the client rejects", async () => {
+    mockRecordCookieChoice.mockRejectedValue(new TypeError("fetch failed"));
+    const { acceptCookiesAction } = await import("../../app/[locale]/consent.actions");
+    await expect(acceptCookiesAction()).resolves.toBeUndefined();
+  });
+
+  it("resolves even when the write is refused", async () => {
+    mockRecordCookieChoice.mockResolvedValue({ ok: false, status: 503, body: null });
+    const { acceptCookiesAction } = await import("../../app/[locale]/consent.actions");
+    await expect(acceptCookiesAction()).resolves.toBeUndefined();
+  });
+
+  it("never writes the ailk-consent cookie", async () => {
+    const { acceptCookiesAction } = await import("../../app/[locale]/consent.actions");
+    await acceptCookiesAction();
+    expect(mockCookieSet).not.toHaveBeenCalledWith("ailk-consent", expect.anything(), expect.anything());
+  });
+});

package/templates/apps/web/lib/__tests__/deck-page.test.ts

@@ -0,0 +1,244 @@
+/**
+ * The deck-page resolver (#8687 D3, AC-2).
+ *
+ * `deckCandidates` and the `DECK_ROUTES` parity are pure functions over the
+ * real routes map. `resolveDeckPage` and `inputsFor` (captured off the
+ * `setDeckPages` registration call) are exercised with `getMdxSource` and
+ * `next/headers` mocked, in `renderPage-extension.test.tsx`'s idiom.
+ */
+import { readFileSync } from "node:fs";
+import path from "node:path";
+
+import { ROUTES } from "@working-theory/templates/routes";
+
+const mockGetMdxSource = jest.fn();
+const mockSetDeckPages = jest.fn();
+
+jest.mock("@working-theory/page-renderer", () => {
+  const actual = jest.requireActual("@working-theory/page-renderer");
+  return {
+    ...actual,
+    getMdxSource: (...args: unknown[]) => mockGetMdxSource(...args),
+    setDeckPages: (...args: unknown[]) => mockSetDeckPages(...args),
+  };
+});
+
+const mockHeaders = jest.fn();
+jest.mock("next/headers", () => ({ headers: () => mockHeaders() }));
+
+const savedLocales = process.env["NEXT_PUBLIC_ENABLED_LOCALES"];
+
+beforeAll(() => {
+  process.env["NEXT_PUBLIC_ENABLED_LOCALES"] = "en,es";
+});
+afterAll(() => {
+  if (savedLocales === undefined) delete process.env["NEXT_PUBLIC_ENABLED_LOCALES"];
+  else process.env["NEXT_PUBLIC_ENABLED_LOCALES"] = savedLocales;
+});
+
+import { DECK_ROUTES, deckCandidates, resolveDeckPage } from "../deck-page";
+import { siteChrome } from "../site-chrome";
+
+describe("deckCandidates (#8687 D3, AC-2)", () => {
+  const LOCALES = ["en", "es"];
+
+  it("/pricing resolves the route row, then the [slug] fallback", () => {
+    expect(deckCandidates("/pricing", LOCALES)).toEqual([
+      { type: "Pricing", slug: "pricing" },
+      { type: "LandingPage", slug: "pricing" },
+      { type: "BlogList", slug: "pricing" },
+    ]);
+  });
+
+  it("/about (core, always scaffolded) resolves the route row only", () => {
+    expect(deckCandidates("/about", LOCALES)).toEqual([
+      { type: "AboutPage", slug: "about" },
+    ]);
+  });
+
+  it("/es/offer/ (no route match) falls through to [slug] alone", () => {
+    expect(deckCandidates("/es/offer/", LOCALES)).toEqual([
+      { type: "LandingPage", slug: "offer" },
+      { type: "BlogList", slug: "offer" },
+    ]);
+  });
+
+  it("/projects/apollo resolves the detail row's directory type", () => {
+    expect(deckCandidates("/projects/apollo", LOCALES)).toEqual([
+      { type: "Project", slug: "apollo" },
+    ]);
+  });
+
+  it("/careers (gateable, no DECK_ROUTES entry) falls through to [slug]", () => {
+    expect(deckCandidates("/careers", LOCALES)).toEqual([
+      { type: "LandingPage", slug: "careers" },
+      { type: "BlogList", slug: "careers" },
+    ]);
+  });
+
+  it.each(["/", "/software", "/sign-in", "/blog/post", "/edit/LandingPage/x", "/a/b"])(
+    "%s resolves no candidates",
+    (pathname) => {
+      expect(deckCandidates(pathname, LOCALES)).toEqual([]);
+    },
+  );
+});
+
+describe("DECK_ROUTES parity (#8687 D3)", () => {
+  it("contains every routes-map row with seed content whose page.tsx renders sections, minus /", () => {
+    // DECK_ROUTES is a fixed superset, not a per-scaffold exact set: a shape
+    // that doesn't ship one of these routes (e.g. a Free scaffold without
+    // /alternatives) simply has no page.tsx there, so deckCandidates/
+    // resolveDeckPage never get a request for it (harmless). What would be a
+    // real bug is the OTHER direction — an actually-shipped sections route
+    // this build's own tree carries that DECK_ROUTES fails to name.
+    const appRoot = path.join(__dirname, "..", "..", "app", "[locale]");
+    const sectionsRoutes = new Set<string>();
+    for (const row of ROUTES) {
+      if (row.route === "/" || !row.contentPath?.startsWith("content/en/")) continue;
+      const dir = row.route
+        .split("/")
+        .filter(Boolean)
+        .map((segment) => (segment.startsWith(":") ? "[slug]" : segment))
+        .join("/");
+      let pageSource: string;
+      try {
+        pageSource = readFileSync(path.join(appRoot, dir, "page.tsx"), "utf8");
+      } catch {
+        continue;
+      }
+      if (!pageSource.includes('bodyMode: "mdx-body"')) {
+        sectionsRoutes.add(row.route);
+      }
+    }
+    const deckRoutesSet = new Set<string>(DECK_ROUTES);
+    const missing = [...sectionsRoutes].filter((route) => !deckRoutesSet.has(route));
+    expect(missing).toEqual([]);
+  });
+});
+
+describe("resolveDeckPage (#8687 D3, AC-2)", () => {
+  beforeEach(() => {
+    mockGetMdxSource.mockReset();
+  });
+
+  it("returns the first candidate with a source", async () => {
+    mockGetMdxSource.mockImplementation((type: string) =>
+      Promise.resolve(
+        type === "LandingPage"
+          ? null
+          : type === "BlogList"
+            ? { frontmatter: { type: "BlogList", slug: "offer" }, body: "" }
+            : null,
+      ),
+    );
+
+    const result = await resolveDeckPage("/es/offer/", "en");
+
+    expect(result).toEqual({
+      type: "BlogList",
+      slug: "offer",
+      frontmatter: { type: "BlogList", slug: "offer" },
+    });
+  });
+
+  it("returns null when a read throws", async () => {
+    mockGetMdxSource.mockRejectedValue(new Error("read failed"));
+
+    expect(await resolveDeckPage("/pricing", "en")).toBeNull();
+  });
+
+  it("returns null for a path with no candidates, with zero getMdxSource calls (NFR 2)", async () => {
+    expect(await resolveDeckPage("/software", "en")).toBeNull();
+    expect(mockGetMdxSource).not.toHaveBeenCalled();
+  });
+});
+
+describe("the registered inputsFor (#8687 D3, AC-2)", () => {
+  beforeEach(() => {
+    mockGetMdxSource.mockReset();
+    mockHeaders.mockReset();
+  });
+
+  function registeredInputsFor(): (ctx: {
+    type: string;
+    slug: string;
+    locale: string;
+  }) => Promise<unknown> {
+    const call = mockSetDeckPages.mock.calls[mockSetDeckPages.mock.calls.length - 1];
+    return (
+      call?.[0] as {
+        inputsFor: (ctx: { type: string; slug: string; locale: string }) => Promise<unknown>;
+      }
+    ).inputsFor;
+  }
+
+  it("resolves the design's inputs when the resolved page matches and opts in", async () => {
+    mockHeaders.mockResolvedValue(new Map([["x-pathname", "/pricing"]]));
+    mockGetMdxSource.mockImplementation((type: string) =>
+      Promise.resolve(
+        type === "Pricing"
+          ? null
+          : type === "LandingPage"
+            ? { frontmatter: { type: "LandingPage", slug: "pricing", layout: "deck" }, body: "" }
+            : null,
+      ),
+    );
+
+    const result = await registeredInputsFor()({
+      type: "LandingPage",
+      slug: "pricing",
+      locale: "en",
+    });
+
+    // The scaffold's generated site-chrome carries the DESIGN's values — minimalism
+    // presents the deck (deckPresentation true), standard does not — so the expected
+    // inputs are read from it rather than hard-coded to one design.
+    const chrome = siteChrome as typeof siteChrome & {
+      deckGrounds?: unknown;
+      deckPresentation?: true;
+    };
+    expect(result).toEqual({
+      ...(chrome.deckGrounds !== undefined ? { deckGrounds: chrome.deckGrounds } : {}),
+      deckPresentation: chrome.deckPresentation === true,
+    });
+  });
+
+  it("returns null when the resolved page does not match this render", async () => {
+    mockHeaders.mockResolvedValue(new Map([["x-pathname", "/pricing"]]));
+    mockGetMdxSource.mockResolvedValue(
+      { frontmatter: { type: "Pricing", slug: "pricing" }, body: "" },
+    );
+
+    const result = await registeredInputsFor()({
+      type: "Pricing",
+      slug: "pricing",
+      locale: "en",
+    });
+
+    expect(result).toBeNull();
+  });
+
+  it("returns null for a resolved page without the field", async () => {
+    mockHeaders.mockResolvedValue(new Map([["x-pathname", "/pricing"]]));
+    mockGetMdxSource.mockImplementation((type: string) =>
+      Promise.resolve(
+        type === "LandingPage"
+          ? { frontmatter: { type: "LandingPage", slug: "pricing" }, body: "" }
+          : null,
+      ),
+    );
+
+    expect(
+      await registeredInputsFor()({ type: "LandingPage", slug: "pricing", locale: "en" }),
+    ).toBeNull();
+  });
+
+  it("returns null with no x-pathname header", async () => {
+    mockHeaders.mockResolvedValue(new Map());
+
+    expect(
+      await registeredInputsFor()({ type: "LandingPage", slug: "pricing", locale: "en" }),
+    ).toBeNull();
+  });
+});

package/templates/apps/web/lib/__tests__/relay.test.ts

@@ -456,6 +456,55 @@ describe("AC-4 — the visitor, unchanged; a cross-site post, refused", () => {
   });
 });
 
+describe("the banner's visitor id (#8438 D12)", () => {
+  const VALID_ID = "11111111-2222-4333-8444-555555555555";
+  const LEAD_PATHS = ["/v1/leads/submit", "/v1/leads/subscribe", "/v1/leads/callback"];
+
+  it.each(LEAD_PATHS)(
+    "%s carries x-ailk-consent-visitor from the request's own ailk-vid cookie",
+    async (path) => {
+      await handleRelay(relayRequest(path, { headers: { cookie: `ailk-vid=${VALID_ID}` } }));
+      expect(sent().headers.get("x-ailk-consent-visitor")).toBe(VALID_ID);
+    },
+  );
+
+  it("sends no header when the request carries no ailk-vid cookie", async () => {
+    await handleRelay(relayRequest("/v1/leads/submit"));
+    expect(sent().headers.get("x-ailk-consent-visitor")).toBeNull();
+  });
+
+  it("sends no header when the cookie value fails the UUID shape", async () => {
+    await handleRelay(relayRequest("/v1/leads/submit", { headers: { cookie: "ailk-vid=not-a-uuid" } }));
+    expect(sent().headers.get("x-ailk-consent-visitor")).toBeNull();
+  });
+
+  it("the schedule route carries no consent-visitor header", async () => {
+    await handleRelay(
+      relayRequest("/v1/schedule/availability", {
+        method: "GET",
+        headers: { cookie: `ailk-vid=${VALID_ID}` },
+      }),
+    );
+    expect(sent().headers.get("x-ailk-consent-visitor")).toBeNull();
+  });
+
+  it("the session route carries no consent-visitor header", async () => {
+    await handleRelay(
+      relayRequest("/v1/commerce/invoices", { headers: { cookie: `ailk-vid=${VALID_ID}` } }),
+    );
+    expect(sent().headers.get("x-ailk-consent-visitor")).toBeNull();
+  });
+
+  it("a client-sent x-ailk-consent-visitor header is stripped — only the cookie counts", async () => {
+    await handleRelay(
+      relayRequest("/v1/leads/submit", {
+        headers: { "x-ailk-consent-visitor": "22222222-2222-4222-8222-222222222222" },
+      }),
+    );
+    expect(sent().headers.get("x-ailk-consent-visitor")).toBeNull();
+  });
+});
+
 describe("hardening — what the site serves, and a missing hub address", () => {
   const mediaType = (res: Response) =>
     res.headers.get("content-type")?.split(";")[0]?.trim();

package/templates/apps/web/lib/__tests__/structured-data.test.tsx

@@ -240,10 +240,12 @@ describe("structured data — every content page builds valid JSON-LD", () => {
     "content/$locale/$typeDir — every page validates as its type",
     async ({ locale, typeDir }) => {
       if (!(SCHEMA_ORG_TYPES as readonly string[]).includes(typeDir)) {
-        // Identity + sub-entity types (Organization, Person, BreadcrumbList,
+        // Identity + sub-entity types (Organization, BreadcrumbList,
         // ContactPoint) hold sub-objects other pages' builders embed — never
         // rendered as pages, and skipped by tools/content-compile the same
-        // way. Anything else is a directory nothing will ever render.
+        // way. Anything else is a directory nothing will ever render. Person
+        // (#8650) is a registered page type (`/about/<slug>`), so it is
+        // covered by the SCHEMA_ORG_TYPES branch above, not this one.
         if (!knownSchemaOrgTypes.has(typeDir)) {
           throw new Error(
             `content/${locale}/${typeDir}: "${typeDir}" is not a registered page type — no route or builder will ever render it (see packages/content-adapters/src/types.ts SCHEMA_ORG_TYPES)`,
@@ -295,10 +297,25 @@ describe("structured data — every content page builds valid JSON-LD", () => {
  * exempt route whose page.tsx does render through `renderPage` fails too,
  * because the reason given for it is false.
  */
+// Literal, not imported: apps/web does not depend on create-ailk (the import
+// boundary). Mirrors packages/create-ailk/src/spoke-checkout.ts's
+// SPOKE_CHECKOUT_PAGE_MARKER; packages/create-ailk/__tests__/
+// spoke-checkout.test.ts pins the two in sync (#8513 AC-5).
+const CHECKOUT_PAGE_MARKER = "GENERATED by create-ailk (#7838)";
+const CHECKOUT_PAGE_NOINDEX_LINE = "robots: { index: false, follow: false }";
+
 const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
   route: string;
   reason: string;
   subtree?: true;
+  /**
+   * Strings the page file must carry for this entry to apply (#8513 D1). An
+   * entry naming no strings applies to its route unconditionally, as every
+   * entry did before. Keys the exemption on the file, not the topology seam:
+   * a spoke can carry a hand-written page at this route, and a site can
+   * edit the generated one — either is checked like any other route.
+   */
+  requires?: readonly string[];
 }> = [
   // Fumadocs routes: JSON-LD is emitted by @working-theory/fumadocs-schema
   // from the fumadocs `.source` collection, which is not built in this
@@ -349,6 +366,10 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
     subtree: true,
   },
   { route: "meet", reason: "booking surface, API-backed", subtree: true },
+  {
+    route: "unsubscribe",
+    reason: "app-shaped landing, API-backed; no content page behind it",
+  },
   // #6084 — both purchase return pages read a Checkout Session (or read
   // nothing, for cancel) and render via SectionRenderer directly; neither
   // is a content-adapter page, and the paid render's own schema.org node
@@ -367,6 +388,23 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
     reason: "auth surfaces, not content pages",
     subtree: true,
   },
+  // #8513 — a spoke carrying commerce gets two generated checkout return
+  // pages (create-ailk #7838): noindex, rendered through SectionRenderer
+  // directly, no JSON-LD. Exempt only when the page on disk still carries
+  // both the generated marker and the noindex line (see `requires` above) —
+  // a hand-written or edited page at either route is checked like any other.
+  {
+    route: "checkout/thank-you",
+    reason:
+      "spoke checkout return page (create-ailk #7838) — noindex, renders sections only, no JSON-LD",
+    requires: [CHECKOUT_PAGE_MARKER, CHECKOUT_PAGE_NOINDEX_LINE],
+  },
+  {
+    route: "checkout/unavailable",
+    reason:
+      "spoke checkout return page (create-ailk #7838) — noindex, renders sections only, no JSON-LD",
+    requires: [CHECKOUT_PAGE_MARKER, CHECKOUT_PAGE_NOINDEX_LINE],
+  },
 ];
 
 interface RouteEntry {
@@ -392,12 +430,20 @@ function walkRoutes(dir: string, out: RouteEntry[] = []): RouteEntry[] {
   return out;
 }
 
-function exemption(route: string): string | undefined {
-  return NO_STRUCTURED_DATA_ROUTES.find(
+function exemption(route: string, src: string): string | undefined {
+  const entry = NO_STRUCTURED_DATA_ROUTES.find(
     (e) =>
       route === e.route ||
       (e.subtree === true && route.startsWith(e.route + "/")),
-  )?.reason;
+  );
+  if (entry === undefined) return undefined;
+  if (
+    entry.requires !== undefined &&
+    !entry.requires.every((s) => src.includes(s))
+  ) {
+    return undefined;
+  }
+  return entry.reason;
 }
 
 // The page identity a route renders — the three shapes
@@ -432,9 +478,8 @@ const RENDER_PAGE_DYNAMIC_RE =
 const GET_MDX_SOURCE_RE = /getMdxSource\s*\(\s*["']([A-Za-z]+)["']/s;
 
 function routeIdentity(
-  file: string,
+  src: string,
 ): { type: string; slug: string | null } | null {
-  const src = readFileSync(file, "utf8");
   const exact = RENDER_PAGE_EXACT_RE.exec(src);
   if (exact) return { type: exact[1] as string, slug: exact[2] as string };
   const dynamic = RENDER_PAGE_DYNAMIC_RE.exec(src);
@@ -487,8 +532,9 @@ describe("structured data — every route emits a valid JSON-LD script", () => {
 
   it.each(routes)("$route", async ({ route, file }) => {
     const label = `/${DEFAULT_LOCALE}${route === "" ? "" : "/" + route}`;
-    const exempt = exemption(route);
-    const identity = routeIdentity(file);
+    const src = readFileSync(file, "utf8");
+    const exempt = exemption(route, src);
+    const identity = routeIdentity(src);
     if (exempt !== undefined) {
       // Declared, with a reason, in NO_STRUCTURED_DATA_ROUTES above. The
       // reason is false for a route that does render through renderPage —
@@ -570,6 +616,51 @@ describe("structured data — every route emits a valid JSON-LD script", () => {
   });
 });
 
+// ── 2a. exemption(route, src) — the generated-checkout routes (#8513) ──────
+//
+// Proof that the two conditional entries above key on the FILE, not the
+// route alone, and that every pre-existing entry is unaffected. The
+// monorepo's own app/[locale]/ has no checkout route (§1 of the spec), so
+// the route walk above never meets one — these cases are what exercise D1 on
+// every PR.
+
+describe("structured data — exemption(route, src) keys the generated checkout routes on the file (#8513)", () => {
+  const GENERATED_SRC = `// The checkout thank-you page — ${CHECKOUT_PAGE_MARKER}.\nexport async function generateMetadata() {\n  return { ${CHECKOUT_PAGE_NOINDEX_LINE} };\n}\n`;
+  const NO_MARKER_SRC = `// hand-written\nexport async function generateMetadata() {\n  return { ${CHECKOUT_PAGE_NOINDEX_LINE} };\n}\n`;
+  const NO_NOINDEX_SRC = `// The checkout thank-you page — ${CHECKOUT_PAGE_MARKER}.\nexport async function generateMetadata() {\n  return {};\n}\n`;
+
+  it("exempts checkout/thank-you only when the file carries both the marker and the noindex line", () => {
+    expect(exemption("checkout/thank-you", GENERATED_SRC)).toContain(
+      "noindex",
+    );
+    expect(exemption("checkout/thank-you", NO_MARKER_SRC)).toBeUndefined();
+    expect(exemption("checkout/thank-you", NO_NOINDEX_SRC)).toBeUndefined();
+  });
+
+  it("exempts checkout/unavailable only when the file carries both the marker and the noindex line", () => {
+    expect(exemption("checkout/unavailable", GENERATED_SRC)).toContain(
+      "noindex",
+    );
+    expect(exemption("checkout/unavailable", NO_MARKER_SRC)).toBeUndefined();
+    expect(exemption("checkout/unavailable", NO_NOINDEX_SRC)).toBeUndefined();
+  });
+
+  it("does not exempt a neighboring checkout route or an unrelated route", () => {
+    expect(exemption("checkout/other", GENERATED_SRC)).toBeUndefined();
+    expect(exemption("about", GENERATED_SRC)).toBeUndefined();
+  });
+
+  it("every pre-existing entry still returns its reason for its own route with any src, subtree entries included", () => {
+    for (const entry of NO_STRUCTURED_DATA_ROUTES) {
+      if (entry.requires !== undefined) continue; // the two conditional entries above, checked above
+      expect(exemption(entry.route, "")).toBe(entry.reason);
+      if (entry.subtree === true) {
+        expect(exemption(`${entry.route}/child`, "")).toBe(entry.reason);
+      }
+    }
+  });
+});
+
 // ── 3. The two defect shapes that shipped, pinned ───────────────────────────
 //
 // These prove the checks above reach the validator rule that rejects each