create-ailk 0.21.0 → 0.22.0

package/templates/apps/web/lib/__tests__/checkout.test.ts

@@ -0,0 +1,243 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * The standard spoke checkout (#8748 D6; spec
+ * docs/specs/8748-a-standard-spoke-checkout-route-spec.md AC-2, AC-3, AC-4).
+ *
+ * `./checkout-config` — the site's own data — is mocked with a fixture in
+ * every case, so this suite passes against any shape of the site's file,
+ * including a pre-#8748 one that also carries `siteBaseUrl` and `fulfil`.
+ * The hub's `leads.submit` is the one external boundary mocked: the
+ * fulfilment must post one lead marked with the site, under the session id as
+ * its Idempotency-Key, with a body that stays byte-identical between attempts
+ * so the hub can replay it.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const mockSubmit = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  leads: { submit: (...args: unknown[]) => mockSubmit(...args) },
+}));
+
+const OFFERINGS = {
+  starter: { kind: "fixed", lookupKey: "acme_starter", cancelPath: "/" },
+};
+const mockSite: { value: Record<string, unknown> } = {
+  value: { site: "acme", offerings: OFFERINGS },
+};
+// eslint-disable-next-line no-restricted-syntax -- #507: the site's checkout-config.ts is the site's own data, not this suite's subject; a fixture stands in for it so the suite holds against any shape a site's file has (#8748 AC-2).
+jest.mock("../checkout-config", () => ({
+  __esModule: true,
+  get checkoutConfig() {
+    return mockSite.value;
+  },
+}));
+
+const mockTopology: { value: "hub" | "spoke" } = { value: "spoke" };
+// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426), not a runtime input; the seam IS the boundary between a hub and a spoke build, and no env or HTTP surface selects it.
+jest.mock("../topology.generated", () => ({
+  __esModule: true,
+  get TOPOLOGY() {
+    return mockTopology.value;
+  },
+}));
+
+type CheckoutModule = typeof import("../checkout");
+
+/** `lib/checkout.ts`, loaded fresh against the current site fixture. */
+function load(site: Record<string, unknown> = { site: "acme", offerings: OFFERINGS }): CheckoutModule {
+  mockSite.value = site;
+  let loaded!: CheckoutModule;
+  jest.isolateModules(() => {
+    loaded = require("../checkout") as CheckoutModule;
+  });
+  return loaded;
+}
+
+/** A test-mode completion as the package hands it to `fulfil`. */
+const COMPLETION = {
+  idempotencyKey: "cs_test_1",
+  sessionId: "cs_test_1",
+  offering: "starter",
+  kind: "fixed" as const,
+  mode: "test" as const,
+  livemode: false,
+  paymentStatus: "paid" as const,
+  amountTotal: 4900,
+  currency: "usd",
+  email: "b@example.com",
+  customerId: "cus_test_1",
+  termsOfService: null,
+  termsStamp: null,
+  metadata: { site: "acme", offering: "starter", kind: "fixed" },
+};
+
+/**
+ * `renderConfig`'s body for COMPLETION, key order included (NFR5), plus the
+ * session's terms consent as its last key (#8778).
+ */
+const EXPECTED_BODY =
+  '{"siteId":"acme","source":"web","email":"b@example.com","payload":{"site":"acme","page":"checkout","offering":"starter","checkoutKind":"fixed","mode":"test","amountTotal":4900,"currency":"usd","stripeCustomerId":"cus_test_1","checkoutSession":"cs_test_1","termsAccepted":null}}';
+
+const SOURCE = readFileSync(join(__dirname, "..", "checkout.ts"), "utf8");
+const ENV = process.env;
+
+beforeEach(() => {
+  mockSubmit.mockReset();
+  mockSubmit.mockResolvedValue({ ok: true, status: 201 });
+  process.env = { ...ENV, AILK_SPOKE_KEY: "spoke-key-fixture" };
+  mockTopology.value = "spoke";
+});
+
+afterAll(() => {
+  process.env = ENV;
+});
+
+describe("spokeCheckoutConfig (#8748 AC-2, AC-4)", () => {
+  it("exports exactly spokeCheckoutConfig, checkoutServed and checkoutNotServed", () => {
+    expect(Object.keys(load()).sort()).toEqual([
+      "checkoutNotServed",
+      "checkoutServed",
+      "spokeCheckoutConfig",
+    ]);
+  });
+
+  it("has exactly site, offerings, siteBaseUrl and fulfil, the offerings being the site's own object", () => {
+    const { spokeCheckoutConfig } = load();
+    expect(Object.keys(spokeCheckoutConfig).sort()).toEqual([
+      "fulfil",
+      "offerings",
+      "site",
+      "siteBaseUrl",
+    ]);
+    expect(spokeCheckoutConfig.site).toBe("acme");
+    expect(spokeCheckoutConfig.offerings).toBe(OFFERINGS);
+  });
+
+  it("takes only site and offerings from a site file that also carries env, siteBaseUrl and fulfil (SEC-8748-B)", async () => {
+    const siteFulfil = jest.fn();
+    const { spokeCheckoutConfig } = load({
+      site: "acme",
+      offerings: OFFERINGS,
+      env: { STRIPE_MODE: "live" },
+      siteBaseUrl: "https://elsewhere.example",
+      fulfil: siteFulfil,
+    });
+    expect(Object.keys(spokeCheckoutConfig).sort()).toEqual([
+      "fulfil",
+      "offerings",
+      "site",
+      "siteBaseUrl",
+    ]);
+    expect("env" in spokeCheckoutConfig).toBe(false);
+    expect(spokeCheckoutConfig.siteBaseUrl).not.toBe("https://elsewhere.example");
+    expect(spokeCheckoutConfig.fulfil).not.toBe(siteFulfil);
+    await spokeCheckoutConfig.fulfil(COMPLETION);
+    expect(siteFulfil).not.toHaveBeenCalled();
+    expect(mockSubmit).toHaveBeenCalledTimes(1);
+  });
+
+  it("reads no Stripe setting and imports no Stripe client (AC-4)", () => {
+    expect(SOURCE).not.toContain("STRIPE_");
+    expect(SOURCE).not.toContain("stripe-client");
+  });
+});
+
+describe("checkoutServed / checkoutNotServed (#8748 D11)", () => {
+  it("serves on a spoke only", () => {
+    const { checkoutServed } = load();
+    mockTopology.value = "spoke";
+    expect(checkoutServed()).toBe(true);
+    mockTopology.value = "hub";
+    expect(checkoutServed()).toBe(false);
+  });
+
+  it("answers 404 with no-store", () => {
+    const res = load().checkoutNotServed();
+    expect(res.status).toBe(404);
+    expect(res.headers.get("cache-control")).toBe("no-store");
+  });
+});
+
+describe("the fulfilment (#8748 AC-3)", () => {
+  it("posts one lead marked with the site, under the session id as its Idempotency-Key", async () => {
+    await load().spokeCheckoutConfig.fulfil(COMPLETION);
+    expect(mockSubmit).toHaveBeenCalledTimes(1);
+    const [body, init] = mockSubmit.mock.calls[0] as [unknown, unknown];
+    expect(body).toEqual({
+      siteId: "acme",
+      source: "web",
+      email: "b@example.com",
+      payload: {
+        site: "acme",
+        page: "checkout",
+        offering: "starter",
+        checkoutKind: "fixed",
+        mode: "test",
+        amountTotal: 4900,
+        currency: "usd",
+        stripeCustomerId: "cus_test_1",
+        checkoutSession: "cs_test_1",
+        termsAccepted: null,
+      },
+    });
+    expect(init).toEqual({ headers: { "Idempotency-Key": "cs_test_1" } });
+    expect(JSON.stringify(body)).toBe(EXPECTED_BODY);
+  });
+
+  it("carries the stamp of the terms the buyer accepted as payload.termsAccepted (#8778)", async () => {
+    await load().spokeCheckoutConfig.fulfil({
+      ...COMPLETION,
+      termsOfService: "accepted",
+      termsStamp: "account_terms@2",
+    });
+    const [body] = mockSubmit.mock.calls[0] as [{ payload: Record<string, unknown> }];
+    expect(body.payload["termsAccepted"]).toBe("account_terms@2");
+  });
+
+  it.each([
+    ["a box not accepted", { termsOfService: null, termsStamp: "account_terms@2" }],
+    ["an accepted box with no stamp", { termsOfService: "accepted" as const, termsStamp: null }],
+  ])("sends termsAccepted: null for %s (#8778)", async (_label, terms) => {
+    await load().spokeCheckoutConfig.fulfil({ ...COMPLETION, ...terms });
+    const [body] = mockSubmit.mock.calls[0] as [{ payload: Record<string, unknown> }];
+    expect(body.payload).toHaveProperty("termsAccepted", null);
+  });
+
+  it("sends the same bytes under the same key on a replay", async () => {
+    const { spokeCheckoutConfig } = load();
+    await spokeCheckoutConfig.fulfil(COMPLETION);
+    await spokeCheckoutConfig.fulfil(COMPLETION);
+    expect(mockSubmit).toHaveBeenCalledTimes(2);
+    const [first, second] = mockSubmit.mock.calls as [
+      [unknown, unknown],
+      [unknown, unknown],
+    ];
+    expect(JSON.stringify(second[0])).toBe(JSON.stringify(first[0]));
+    expect(second[1]).toEqual(first[1]);
+  });
+
+  it("makes no call for a completion without an email", async () => {
+    await load().spokeCheckoutConfig.fulfil({ ...COMPLETION, email: null });
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it("rejects with no call when AILK_SPOKE_KEY is unset", async () => {
+    delete process.env["AILK_SPOKE_KEY"];
+    await expect(load().spokeCheckoutConfig.fulfil(COMPLETION)).rejects.toThrow(
+      "AILK_SPOKE_KEY is not set",
+    );
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it("rejects when the hub answers { ok: false }", async () => {
+    mockSubmit.mockResolvedValue({ ok: false, status: 422 });
+    await expect(load().spokeCheckoutConfig.fulfil(COMPLETION)).rejects.toThrow(
+      "hub lead write answered 422",
+    );
+  });
+});

package/templates/apps/web/lib/__tests__/consent-policies.test.ts

@@ -0,0 +1,23 @@
+/**
+ * The localized policy map (#8765 D9, AC-5): one map, the registry's keys,
+ * each path carrying the locale prefix off the default locale.
+ */
+import { consentPoliciesFor } from "../consent-policies";
+
+describe("consentPoliciesFor", () => {
+  it("is /contact's three destinations for the default locale", () => {
+    expect(consentPoliciesFor("en")).toEqual({
+      terms: "/terms",
+      privacy: "/privacy",
+      working_agreement: "/working-agreement",
+    });
+  });
+
+  it("prefixes every path for another locale", () => {
+    expect(consentPoliciesFor("fr")).toEqual({
+      terms: "/fr/terms",
+      privacy: "/fr/privacy",
+      working_agreement: "/fr/working-agreement",
+    });
+  });
+});

package/templates/apps/web/lib/__tests__/deck-page.test.ts

@@ -197,10 +197,15 @@ describe("the registered inputsFor (#8687 D3, AC-2)", () => {
     const chrome = siteChrome as typeof siteChrome & {
       deckGrounds?: unknown;
       deckPresentation?: true;
+      deckAnchors?: "bare";
     };
     expect(result).toEqual({
       ...(chrome.deckGrounds !== undefined ? { deckGrounds: chrome.deckGrounds } : {}),
       deckPresentation: chrome.deckPresentation === true,
+      // #8773 — the design's slide naming rides along only when it presents and chose bare.
+      ...(chrome.deckPresentation === true && chrome.deckAnchors === "bare"
+        ? { deckAnchorStyle: "bare" }
+        : {}),
     });
   });
 

package/templates/apps/web/lib/__tests__/structured-data.test.tsx

@@ -297,11 +297,13 @@ describe("structured data — every content page builds valid JSON-LD", () => {
  * exempt route whose page.tsx does render through `renderPage` fails too,
  * because the reason given for it is false.
  */
-// Literal, not imported: apps/web does not depend on create-ailk (the import
-// boundary). Mirrors packages/create-ailk/src/spoke-checkout.ts's
-// SPOKE_CHECKOUT_PAGE_MARKER; packages/create-ailk/__tests__/
-// spoke-checkout.test.ts pins the two in sync (#8513 AC-5).
-const CHECKOUT_PAGE_MARKER = "GENERATED by create-ailk (#7838)";
+// The marker both standard spoke checkout pages carry in their header comment
+// (apps/web/app/[locale]/checkout/{thank-you,unavailable}/page.tsx, #8748 D5).
+const CHECKOUT_PAGE_MARKER = "Standard spoke checkout page (#8748)";
+// The marker create-ailk rendered before #8748. A spoke scaffolded then keeps
+// its rendered pages through `create-ailk update` (they are not in its
+// record), so its updated copy of this test must still exempt them.
+const LEGACY_CHECKOUT_PAGE_MARKER = "GENERATED by create-ailk (#7838)";
 const CHECKOUT_PAGE_NOINDEX_LINE = "robots: { index: false, follow: false }";
 
 const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
@@ -313,9 +315,10 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
    * entry naming no strings applies to its route unconditionally, as every
    * entry did before. Keys the exemption on the file, not the topology seam:
    * a spoke can carry a hand-written page at this route, and a site can
-   * edit the generated one — either is checked like any other route.
+   * edit the generated one — either is checked like any other route. A
+   * nested list is any one of its strings.
    */
-  requires?: readonly string[];
+  requires?: ReadonlyArray<string | readonly string[]>;
 }> = [
   // Fumadocs routes: JSON-LD is emitted by @working-theory/fumadocs-schema
   // from the fumadocs `.source` collection, which is not built in this
@@ -388,22 +391,28 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
     reason: "auth surfaces, not content pages",
     subtree: true,
   },
-  // #8513 — a spoke carrying commerce gets two generated checkout return
-  // pages (create-ailk #7838): noindex, rendered through SectionRenderer
-  // directly, no JSON-LD. Exempt only when the page on disk still carries
-  // both the generated marker and the noindex line (see `requires` above) —
-  // a hand-written or edited page at either route is checked like any other.
+  // #8513 — the two standard spoke checkout return pages (#8748 D5):
+  // noindex, rendered through SectionRenderer directly, no JSON-LD. Exempt
+  // only when the page on disk still carries both the standard's marker and
+  // the noindex line (see `requires` above) — a hand-written or edited page
+  // at either route is checked like any other.
   {
     route: "checkout/thank-you",
     reason:
-      "spoke checkout return page (create-ailk #7838) — noindex, renders sections only, no JSON-LD",
-    requires: [CHECKOUT_PAGE_MARKER, CHECKOUT_PAGE_NOINDEX_LINE],
+      "spoke checkout return page (#8748) — noindex, renders sections only, no JSON-LD",
+    requires: [
+      [CHECKOUT_PAGE_MARKER, LEGACY_CHECKOUT_PAGE_MARKER],
+      CHECKOUT_PAGE_NOINDEX_LINE,
+    ],
   },
   {
     route: "checkout/unavailable",
     reason:
-      "spoke checkout return page (create-ailk #7838) — noindex, renders sections only, no JSON-LD",
-    requires: [CHECKOUT_PAGE_MARKER, CHECKOUT_PAGE_NOINDEX_LINE],
+      "spoke checkout return page (#8748) — noindex, renders sections only, no JSON-LD",
+    requires: [
+      [CHECKOUT_PAGE_MARKER, LEGACY_CHECKOUT_PAGE_MARKER],
+      CHECKOUT_PAGE_NOINDEX_LINE,
+    ],
   },
 ];
 
@@ -439,7 +448,9 @@ function exemption(route: string, src: string): string | undefined {
   if (entry === undefined) return undefined;
   if (
     entry.requires !== undefined &&
-    !entry.requires.every((s) => src.includes(s))
+    !entry.requires.every((s) =>
+      typeof s === "string" ? src.includes(s) : s.some((any) => src.includes(any)),
+    )
   ) {
     return undefined;
   }
@@ -645,6 +656,12 @@ describe("structured data — exemption(route, src) keys the generated checkout
     expect(exemption("checkout/unavailable", NO_NOINDEX_SRC)).toBeUndefined();
   });
 
+  it("still exempts a page create-ailk rendered before #8748, which update leaves in place", () => {
+    const legacy = `// The checkout thank-you page — ${LEGACY_CHECKOUT_PAGE_MARKER}.\nexport async function generateMetadata() {\n  return { ${CHECKOUT_PAGE_NOINDEX_LINE} };\n}\n`;
+    expect(exemption("checkout/thank-you", legacy)).toContain("noindex");
+    expect(exemption("checkout/unavailable", legacy)).toContain("noindex");
+  });
+
   it("does not exempt a neighboring checkout route or an unrelated route", () => {
     expect(exemption("checkout/other", GENERATED_SRC)).toBeUndefined();
     expect(exemption("about", GENERATED_SRC)).toBeUndefined();

package/templates/apps/web/lib/account-invite.ts

@@ -0,0 +1,37 @@
+/**
+ * account-invite.ts — the /contact thank-you's account link (#8757 D8): the
+ * path that starts sign-in on this site with the submitter's email prefilled
+ * and lands on their account. It signs no one in; the email is only the
+ * sign-in form's starting value (NFR2).
+ *
+ * Built from the generated sign-in provider (`SIGN_IN_PROVIDER`):
+ *   - `site` — this site's own `/sign-in`, locale-prefixed like every page
+ *     (`localeHref`), with `next` = the locale's `/account` and `email`;
+ *   - `hub`  — a hub-sign-in spoke starts at `/api/hub-session/sign-in`
+ *     (`accountInvitePath("hub", …)`), which hands the hint to the hub;
+ *   - `none` — no sign-in, so no link.
+ * An email the hint schema refuses (`accountEmailHintSchema`) gives no link.
+ * The query is built with `URLSearchParams` (SEC-8757-L).
+ */
+import { localeHref } from "@working-theory/ui";
+import { accountEmailHintSchema, accountInvitePath } from "@working-theory/validation";
+
+import { SIGN_IN_PROVIDER } from "./topology.generated";
+
+export function accountInviteHref(locale: string, email: string): string | null {
+  const hint = accountEmailHintSchema.safeParse(email);
+  if (!hint.success) return null;
+  switch (SIGN_IN_PROVIDER) {
+    case "site": {
+      const query = new URLSearchParams({
+        next: localeHref(locale, "/account"),
+        email: hint.data,
+      });
+      return `${localeHref(locale, "/sign-in")}?${query.toString()}`;
+    }
+    case "hub":
+      return accountInvitePath("hub", hint.data);
+    default:
+      return null;
+  }
+}

package/templates/apps/web/lib/checkout-config.ts

@@ -0,0 +1,27 @@
+// checkout-config.ts — this spoke's checkout, as data (#7838, #8748).
+//
+// The one checkout file this site edits. Written once by create-ailk and yours
+// from then on: `create-ailk update` never rewrites it. The standard checkout
+// (lib/checkout.ts, the buy route and the Stripe webhook route) reads only
+// `site` and `offerings` from it and is kept current by `create-ailk update`.
+// Keep it to data: no import, and no code.
+//
+// site       Stamped on every Checkout Session as metadata.site. This site's
+//            webhook acts only on its own stamp, and the hub ignores any stamp
+//            that is not its own, so the stamp must be unique on the Stripe
+//            account this site shares. Never "default". Change it only before
+//            any price exists: every lookup key starts with it.
+// offerings  slug -> Stripe lookup_key. The buy link is /api/checkout/<slug>,
+//            and any other slug answers 404. Name an offering's slug after the
+//            last segment of the Service or Product page that sells it: that
+//            is the key the hub's plan rule and a magnet's checkoutOffering
+//            use. scaffold-commerce replaces the placeholder below.
+const SITE = "example-site";
+
+export const checkoutConfig = {
+  site: SITE,
+  offerings: {
+    // A placeholder until scaffold-commerce creates this site's prices.
+    example: { kind: "fixed", lookupKey: `${SITE}_example`, cancelPath: "/" },
+  },
+};

package/templates/apps/web/lib/checkout.ts

@@ -0,0 +1,93 @@
+// checkout.ts — the standard spoke checkout (#8748).
+//
+// The standard every selling spoke shares, kept current by `create-ailk
+// update`: do not edit it. This site's checkout is data in
+// lib/checkout-config.ts, the one file to edit. Only the buy route and the
+// Stripe webhook route import this file, and it never imports the checkout
+// package: every guarantee lives there and arrives by a package bump.
+//
+// spokeCheckoutConfig  What the two routes build their handlers from. It reads
+//                      only `site` and `offerings` from the site's file, so no
+//                      other key a site declares reaches the package.
+// fulfil               Runs for each paid session, at least once. It posts one
+//                      lead to the hub with the session id as its
+//                      Idempotency-Key, so a repeat writes nothing new. The hub
+//                      dedupes only an identical body: change the payload's
+//                      shape only when no webhook is failing. `termsAccepted`
+//                      is the stamp of the terms the buyer ticked in Stripe's
+//                      box, else null: the hub records the buyer's checkout
+//                      consent grant from it (#8778).
+import { leads } from "@working-theory/api-client";
+
+import { resolveBaseUrl } from "../src/lib/routes";
+
+import { checkoutConfig } from "./checkout-config";
+import { TOPOLOGY } from "./topology.generated";
+
+/** What the fulfilment reads from a completed checkout. */
+interface CompletedCheckout {
+  idempotencyKey: string;
+  sessionId: string;
+  offering: string;
+  kind: "fixed" | "quoted";
+  mode: "test" | "live";
+  amountTotal: number | null;
+  currency: string | null;
+  email: string | null;
+  customerId: string | null;
+  termsOfService: "accepted" | null;
+  termsStamp: string | null;
+}
+
+async function fulfil(checkout: CompletedCheckout): Promise<void> {
+  if (checkout.email === null) return;
+  // No spoke key: the hub cannot place the lead in this site's workspace.
+  // Fail, so Stripe retries and the dashboard shows a failed webhook.
+  if (!process.env.AILK_SPOKE_KEY)
+    throw new Error("AILK_SPOKE_KEY is not set");
+  const result = await leads.submit(
+    {
+      siteId: checkoutConfig.site,
+      source: "web",
+      email: checkout.email,
+      payload: {
+        site: checkoutConfig.site,
+        page: "checkout",
+        offering: checkout.offering,
+        checkoutKind: checkout.kind,
+        mode: checkout.mode,
+        amountTotal: checkout.amountTotal,
+        currency: checkout.currency,
+        stripeCustomerId: checkout.customerId,
+        checkoutSession: checkout.sessionId,
+        termsAccepted:
+          checkout.termsOfService === "accepted" ? checkout.termsStamp : null,
+      },
+    },
+    { headers: { "Idempotency-Key": checkout.idempotencyKey } },
+  );
+  // A replay under the same key answers 201 with the first lead; any
+  // failure (422 idempotency_key_reused included) makes Stripe retry.
+  if (!result.ok) throw new Error(`hub lead write answered ${result.status}`);
+}
+
+/** The config both routes pass to the checkout package, built key by key. */
+export const spokeCheckoutConfig = {
+  site: checkoutConfig.site,
+  offerings: checkoutConfig.offerings,
+  siteBaseUrl: resolveBaseUrl(),
+  fulfil,
+};
+
+/** Whether this build serves the checkout: a spoke only (#8748 D11). */
+export function checkoutServed(): boolean {
+  return TOPOLOGY === "spoke";
+}
+
+/** What either route answers on a build that does not serve the checkout. */
+export function checkoutNotServed(): Response {
+  return new Response(null, {
+    status: 404,
+    headers: { "Cache-Control": "no-store" },
+  });
+}

package/templates/apps/web/lib/consent-policies.ts

@@ -0,0 +1,22 @@
+/**
+ * consent-policies.ts — the one policy map an agreement surface links
+ * through (#8765 D9, spec docs/specs/8765-sign-up-refuses-without-the-spec.md).
+ *
+ * A consent statement names its links by key (`[Terms](terms)`); the keys
+ * resolve against the registry's `policies` map. This localizes that map, so
+ * the sign-up page, the account interstitial and the Privacy tab link Terms,
+ * Privacy Policy and Working Agreement to the same three pages `/contact`
+ * builds inline (#8761 decision, C6).
+ */
+import { localeHref } from "@working-theory/ui";
+import { SITE_CONSENT_CONFIG_DEFAULTS } from "@working-theory/validation";
+
+/** The registry's policy map with each path localized for `locale`. */
+export function consentPoliciesFor(locale: string): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(SITE_CONSENT_CONFIG_DEFAULTS.policies).map(([key, path]) => [
+      key,
+      localeHref(locale, path),
+    ]),
+  );
+}

package/templates/apps/web/lib/deck-page.ts

@@ -55,6 +55,8 @@ export const DECK_ROUTES = [
 type Chrome = SiteChrome & {
   deckGrounds?: DeckPageInputs["deckGrounds"];
   deckPresentation?: true;
+  /** #8773 — present only when the design chooses bare slide anchors. */
+  deckAnchors?: "bare";
 };
 const chrome: Chrome = siteChrome;
 
@@ -180,6 +182,10 @@ async function inputsFor(ctx: DeckPageContext): Promise<DeckPageInputs | null> {
   return {
     ...(chrome.deckGrounds !== undefined ? { deckGrounds: chrome.deckGrounds } : {}),
     deckPresentation: chrome.deckPresentation === true,
+    // #8773 — a page that presents names its slides as the design chose.
+    ...(chrome.deckPresentation === true && chrome.deckAnchors === "bare"
+      ? { deckAnchorStyle: "bare" as const }
+      : {}),
   };
 }