create-ailk 0.21.0 → 0.23.0

package/templates/apps/web/middleware.ts

@@ -26,8 +26,11 @@
 import { NextRequest, NextResponse } from "next/server";
 import createMiddleware from "next-intl/middleware";
 
+import { isBookingPath } from "./lib/auth-routes";
+import { SCHEDULING_PAGES } from "./lib/modules.generated";
 import {
   DEFAULT_SECURITY_HEADERS,
+  SCHEDULING_SECURITY_HEADERS,
   applyHeaders,
 } from "./security-headers.config";
 
@@ -91,8 +94,15 @@ export function middleware(request: NextRequest): NextResponse {
   // Step 2: run next-intl middleware (locale detection + rewrite/redirect)
   const intlResponse = intlMiddleware(requestWithPathname) as NextResponse;
 
-  // Step 3: apply the 7 baseline security headers to the response
-  applyHeaders(intlResponse.headers, DEFAULT_SECURITY_HEADERS);
+  // Step 3: apply the 7 baseline security headers to the response. The booking
+  // pages of a site that carries the scheduling module get the same map with
+  // Cal.com's origin added to the CSP (#8843 D12); no other page does.
+  applyHeaders(
+    intlResponse.headers,
+    SCHEDULING_PAGES && isBookingPath(request.nextUrl.pathname, enabledLocales)
+      ? SCHEDULING_SECURITY_HEADERS
+      : DEFAULT_SECURITY_HEADERS,
+  );
 
   return intlResponse;
 }

package/templates/apps/web/package.json

@@ -30,6 +30,7 @@
     "@working-theory/schema-pack-registry": "workspace:*",
     "@working-theory/schema-validator": "workspace:*",
     "@working-theory/site-config": "workspace:*",
+    "@working-theory/spoke-checkout": "workspace:*",
     "@working-theory/templates": "workspace:*",
     "@working-theory/theme": "workspace:*",
     "@working-theory/ui": "workspace:*",

package/templates/apps/web/security-headers.config.ts

@@ -125,6 +125,23 @@ export function buildHeaders(
 export const DEFAULT_SECURITY_HEADERS: Readonly<Record<string, string>> =
   Object.freeze(buildHeaders());
 
+/**
+ * The booking pages' CSP additions (#8843 D12). The scheduling module's
+ * `scheduler-embed` section loads Cal.com's script and frames its booker, so
+ * these pages — and only these — name the provider origin. `'self'` in
+ * `frame-src` keeps same-origin frames working, which `default-src 'self'`
+ * allowed until the directive existed.
+ */
+export const SCHEDULING_CSP: CspDirectiveMap = Object.freeze({
+  "script-src": Object.freeze(["https://app.cal.com"]),
+  "connect-src": Object.freeze(["https://app.cal.com"]),
+  "frame-src": Object.freeze(["'self'", "https://app.cal.com"]),
+});
+
+/** The header map for the booking pages: the default plus `SCHEDULING_CSP`. */
+export const SCHEDULING_SECURITY_HEADERS: Readonly<Record<string, string>> =
+  Object.freeze(buildHeaders({ csp: SCHEDULING_CSP }));
+
 /** Write every entry from a header map onto a Headers object. */
 export function applyHeaders(
   target: Headers,

package/templates/apps/web/src/lib/__tests__/lead-write.test.ts

@@ -0,0 +1,187 @@
+/**
+ * The site's one lead writer (#8747): every lead carries `payload.site` (from
+ * `AILK_LEAD_SITE`) and `payload.page`, spread last so no caller field can
+ * override them; no `siteId` is sent (the hub names the tenant itself); only
+ * the visitor and consent-visitor headers are forwarded; a thrown submit
+ * resolves as `{ ok: false, status: 0 }` and logs no field value.
+ */
+jest.mock("@working-theory/api-client", () => ({
+  leads: { submit: jest.fn() },
+}));
+
+import { leads } from "@working-theory/api-client";
+
+import { writeLead } from "../lead-write";
+
+const mockSubmit = leads.submit as jest.Mock;
+const priorSite = process.env.AILK_LEAD_SITE;
+
+afterEach(() => {
+  jest.clearAllMocks();
+  if (priorSite === undefined) delete process.env.AILK_LEAD_SITE;
+  else process.env.AILK_LEAD_SITE = priorSite;
+});
+
+type Body = { siteId?: unknown; source: string; email: string; payload: Record<string, unknown> };
+
+function sentBody(): Body {
+  return mockSubmit.mock.calls[0][0] as Body;
+}
+
+describe("writeLead — the site marker", () => {
+  it("marks payload.site from AILK_LEAD_SITE and payload.page from the caller, and sends no siteId", async () => {
+    process.env.AILK_LEAD_SITE = "wendihenry";
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: { id: "lead_1", persisted: "db" } });
+
+    const res = await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { name: "Jane" },
+    });
+
+    expect(res.ok).toBe(true);
+    expect(sentBody()).toEqual({
+      source: "contact-form",
+      email: "jane@example.com",
+      payload: { name: "Jane", site: "wendihenry", page: "contact" },
+    });
+    expect(sentBody()).not.toHaveProperty("siteId");
+  });
+
+  it("a caller's own site or page field never overrides the marker", async () => {
+    process.env.AILK_LEAD_SITE = "wendihenry";
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { site: "attacker", page: "checkout" },
+    });
+
+    expect(sentBody().payload).toEqual({ site: "wendihenry", page: "contact" });
+  });
+
+  it("trims AILK_LEAD_SITE", async () => {
+    process.env.AILK_LEAD_SITE = "  wendihenry\n";
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({ source: "contact-form", email: "jane@example.com", page: "contact" });
+
+    expect(sentBody().payload.site).toBe("wendihenry");
+  });
+
+  it.each([
+    ["unset", undefined],
+    ["empty", ""],
+    ["blank", "   "],
+  ])("with AILK_LEAD_SITE %s, writes no site — and drops a caller's own site", async (_label, value) => {
+    if (value === undefined) delete process.env.AILK_LEAD_SITE;
+    else process.env.AILK_LEAD_SITE = value;
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { name: "Jane", site: "attacker" },
+    });
+
+    expect(sentBody().payload).toEqual({ name: "Jane", page: "contact" });
+  });
+});
+
+describe("writeLead — forwarded headers", () => {
+  it("forwards only the visitor and consent-visitor headers", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead(
+      { source: "contact-form", email: "jane@example.com", page: "contact" },
+      {
+        headers: {
+          "x-ailk-visitor-ip": "203.0.113.5",
+          "x-ailk-visitor-forward-key": "k",
+          "x-ailk-consent-visitor": "6f1e2a3b-4c5d-4e6f-8a9b-0c1d2e3f4a5b",
+          "x-ailk-spoke-key": "forged",
+          "content-type": "text/plain",
+        },
+      },
+    );
+
+    expect(mockSubmit.mock.calls[0][1]).toEqual({
+      headers: {
+        "x-ailk-visitor-ip": "203.0.113.5",
+        "x-ailk-visitor-forward-key": "k",
+        "x-ailk-consent-visitor": "6f1e2a3b-4c5d-4e6f-8a9b-0c1d2e3f4a5b",
+      },
+    });
+  });
+
+  it("calls leads.submit with one argument when no header survives", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead(
+      { source: "contact-form", email: "jane@example.com", page: "contact" },
+      { headers: { "x-ailk-spoke-key": "forged" } },
+    );
+
+    expect(mockSubmit.mock.calls[0]).toHaveLength(1);
+  });
+});
+
+describe("writeLead — a thrown submit", () => {
+  it("resolves as status 0 and logs the error name only", async () => {
+    mockSubmit.mockRejectedValueOnce(new TypeError("fetch failed for jane@example.com"));
+    const spy = jest.spyOn(console, "error").mockImplementation(() => undefined);
+
+    const res = await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      payload: { name: "Jane" },
+    });
+
+    expect(res).toEqual({ ok: false, status: 0, body: null });
+    const logged = spy.mock.calls.flat().map(String).join(" ");
+    expect(logged).toContain("TypeError");
+    expect(logged).not.toContain("jane@example.com");
+    expect(logged).not.toContain("Jane");
+    spy.mockRestore();
+  });
+
+  it("passes the api-client's own failure through unchanged", async () => {
+    const failure = { ok: false, status: 503, body: { error: "lead_capture_not_configured" } };
+    mockSubmit.mockResolvedValueOnce(failure);
+
+    expect(
+      await writeLead({ source: "contact-form", email: "jane@example.com", page: "contact" }),
+    ).toEqual(failure);
+  });
+});
+
+describe("writeLead — terms acceptance (#8730)", () => {
+  it("sends consent: true at the top level when the caller says the terms were accepted", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({
+      source: "contact-form",
+      email: "jane@example.com",
+      page: "contact",
+      consent: true,
+      payload: { name: "Jane" },
+    });
+
+    const body = mockSubmit.mock.calls[0][0] as Record<string, unknown>;
+    expect(body["consent"]).toBe(true);
+    expect((body["payload"] as Record<string, unknown>)["consent"]).toBeUndefined();
+  });
+
+  it("sends no consent key at all when the caller does not set it", async () => {
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: {} });
+
+    await writeLead({ source: "contact-form", email: "jane@example.com", page: "contact" });
+
+    expect(mockSubmit.mock.calls[0][0]).not.toHaveProperty("consent");
+  });
+});

package/templates/apps/web/src/lib/__tests__/rate-limit.test.ts

@@ -0,0 +1,67 @@
+/**
+ * The per-visitor limiter the /contact action runs before it writes a lead
+ * (#8747): a fixed window per key, refusing the call past the limit, and a
+ * client address read from the platform's own headers.
+ */
+import {
+  __resetRateLimit,
+  checkRateLimit,
+  clientIpFromHeaders,
+} from "../rate-limit";
+
+const WINDOW_MS = 10 * 60 * 1000;
+
+function headersOf(values: Record<string, string>): { get(name: string): string | null } {
+  return { get: (name) => values[name] ?? null };
+}
+
+afterEach(() => {
+  __resetRateLimit();
+  jest.useRealTimers();
+});
+
+describe("checkRateLimit", () => {
+  it("admits exactly `limit` calls in a window and refuses the next", () => {
+    for (let i = 0; i < 30; i += 1) {
+      expect(checkRateLimit("contact:203.0.113.5", 30, WINDOW_MS)).toBe(true);
+    }
+    expect(checkRateLimit("contact:203.0.113.5", 30, WINDOW_MS)).toBe(false);
+  });
+
+  it("counts each key on its own", () => {
+    for (let i = 0; i < 30; i += 1) checkRateLimit("contact:a", 30, WINDOW_MS);
+    expect(checkRateLimit("contact:a", 30, WINDOW_MS)).toBe(false);
+    expect(checkRateLimit("contact:b", 30, WINDOW_MS)).toBe(true);
+  });
+
+  it("opens a new window once the old one ends", () => {
+    jest.useFakeTimers();
+    jest.setSystemTime(new Date("2026-10-15T10:00:00Z"));
+    for (let i = 0; i < 30; i += 1) checkRateLimit("contact:a", 30, WINDOW_MS);
+    expect(checkRateLimit("contact:a", 30, WINDOW_MS)).toBe(false);
+
+    jest.setSystemTime(new Date("2026-10-15T10:10:00Z"));
+    expect(checkRateLimit("contact:a", 30, WINDOW_MS)).toBe(true);
+  });
+});
+
+describe("clientIpFromHeaders", () => {
+  it("prefers x-vercel-forwarded-for, first value", () => {
+    expect(
+      clientIpFromHeaders(
+        headersOf({
+          "x-vercel-forwarded-for": "198.51.100.7, 10.0.0.1",
+          "x-forwarded-for": "203.0.113.5",
+        }),
+      ),
+    ).toBe("198.51.100.7");
+  });
+
+  it("falls back to x-forwarded-for, then x-real-ip, then unknown", () => {
+    expect(clientIpFromHeaders(headersOf({ "x-forwarded-for": "203.0.113.5, 10.0.0.1" }))).toBe(
+      "203.0.113.5",
+    );
+    expect(clientIpFromHeaders(headersOf({ "x-real-ip": "192.0.2.9" }))).toBe("192.0.2.9");
+    expect(clientIpFromHeaders(headersOf({}))).toBe("unknown");
+  });
+});

package/templates/apps/web/src/lib/lead-write.ts

@@ -0,0 +1,90 @@
+/**
+ * lead-write.ts — this site's lead writer (#8747): the /contact action writes
+ * through it, and so can any other page that writes a lead.
+ *
+ * A lead goes to `POST /v1/leads/submit` through `@working-theory/api-client`.
+ * The API resolves the lead's workspace itself — from the spoke key on a hub,
+ * from its own site alias otherwise — and ignores a body `siteId`, so none is
+ * sent. The site marks itself in the payload instead: `payload.site` is
+ * `AILK_LEAD_SITE` (the same variable `apps/mcp`'s `capture_lead` reads,
+ * `LEAD_SITE_MARKER_KEY`) and `payload.page` the page key, both spread LAST so
+ * no caller field can override them. With `AILK_LEAD_SITE` unset or blank the
+ * lead carries no `site` at all — a caller's own `site` is dropped, never sent.
+ *
+ * The marker is attribution, not authorization: the route is public and a
+ * direct caller can write any `payload.site`. Nothing may gate on it.
+ *
+ * Terms acceptance (#8730): a caller that collected the visitor's acceptance
+ * passes `consent: true`, sent as the body's top-level `consent`. The API
+ * refuses a contact lead without it and records `payload.consent` itself, so
+ * nothing about the acceptance is written into the payload here.
+ *
+ * Forwarded headers: only the two `visitorForwardHeaders` builds (#7394) and
+ * the consent-visitor id (#8438 D12) reach the api-client, so no caller can
+ * set its own `x-ailk-spoke-key` or `content-type`. With none of the three,
+ * `leads.submit` is called with one argument.
+ *
+ * Never throws. The api-client's own result passes through unchanged, so a
+ * caller still reads the API's 503 `lead_capture_not_configured`. A thrown
+ * submit — the API could not be reached — resolves as
+ * `{ ok: false, status: 0, body: null }` and logs the error's NAME only: its
+ * message could echo the payload.
+ */
+import { leads } from "@working-theory/api-client";
+import { LEAD_SITE_MARKER_KEY } from "@working-theory/validation";
+
+export interface LeadWriteInput {
+  source: string;
+  email: string;
+  /** The page key the marker carries, e.g. `contact` or `checkout`. */
+  page: string;
+  /** The visitor accepted the terms (#8730). Sent only when `true`. */
+  consent?: boolean;
+  payload?: Record<string, unknown>;
+}
+
+type SubmitInit = Parameters<typeof leads.submit>[1];
+type SubmitResult = Awaited<ReturnType<typeof leads.submit>>;
+
+/** The only request headers a lead write forwards. */
+const FORWARDED_HEADERS = [
+  "x-ailk-visitor-ip",
+  "x-ailk-visitor-forward-key",
+  "x-ailk-consent-visitor",
+] as const;
+
+function forwardOnly(init: SubmitInit): SubmitInit {
+  const headers: Record<string, string> = {};
+  for (const name of FORWARDED_HEADERS) {
+    const value = init?.headers?.[name];
+    if (typeof value === "string") headers[name] = value;
+  }
+  return Object.keys(headers).length > 0 ? { headers } : undefined;
+}
+
+/** The site marker from configuration, or `undefined` when unset or blank. */
+function leadSite(): string | undefined {
+  return process.env.AILK_LEAD_SITE?.trim() || undefined;
+}
+
+export async function writeLead(input: LeadWriteInput, init?: SubmitInit): Promise<SubmitResult> {
+  const site = leadSite();
+  const { [LEAD_SITE_MARKER_KEY]: _callerSite, ...callerPayload } = input.payload ?? {};
+  const body = {
+    source: input.source,
+    email: input.email,
+    ...(input.consent === true && { consent: true }),
+    payload: {
+      ...callerPayload,
+      ...(site && { [LEAD_SITE_MARKER_KEY]: site }),
+      page: input.page,
+    },
+  };
+  const forward = forwardOnly(init);
+  try {
+    return forward ? await leads.submit(body, forward) : await leads.submit(body);
+  } catch (err) {
+    console.error(`[lead-write] submit failed: ${err instanceof Error ? err.name : "unknown"}`);
+    return { ok: false, status: 0, body: null };
+  }
+}

package/templates/apps/web/src/lib/rate-limit.ts

@@ -0,0 +1,79 @@
+/**
+ * rate-limit.ts — a best-effort, in-memory, per-instance limiter (#8747).
+ *
+ * The /contact Server Action runs it before it writes a lead. From a server
+ * action the hub sees this site's own egress address, so without a limit
+ * here one visitor could drain the hub's per-IP budget for every visitor of
+ * the site. Brought upstream from the consumer sites' copies
+ * (salessmyth/samhenry, salessmyth/wendihenry `apps/web/src/lib/rate-limit.ts`).
+ *
+ * NOT a distributed limiter: state lives in one serverless instance's memory
+ * and resets on a cold start. It raises the bar against a flood on one warm
+ * instance; it does not stop one spread across many. The hub keeps its own
+ * per-IP limit on the route.
+ */
+
+type Bucket = { count: number; resetAt: number };
+
+const buckets = new Map<string, Bucket>();
+
+// Bound the map so a caller rotating keys (spoofed addresses) cannot grow it
+// without limit between resets.
+const MAX_TRACKED_KEYS = 5000;
+
+/** Test-only reset. Not reachable from a request. */
+export function __resetRateLimit(): void {
+  buckets.clear();
+}
+
+/**
+ * Fixed-window check. `true` when the caller is under `limit` in the current
+ * window (and counts the call); `false` once it has used `limit` calls.
+ */
+export function checkRateLimit(key: string, limit: number, windowMs: number): boolean {
+  const now = Date.now();
+  const existing = buckets.get(key);
+
+  if (!existing || existing.resetAt <= now) {
+    if (buckets.size >= MAX_TRACKED_KEYS) pruneExpired(now);
+    buckets.set(key, { count: 1, resetAt: now + windowMs });
+    return true;
+  }
+
+  if (existing.count >= limit) return false;
+
+  existing.count += 1;
+  return true;
+}
+
+function pruneExpired(now: number): void {
+  for (const [key, bucket] of buckets) {
+    if (bucket.resetAt <= now) buckets.delete(key);
+  }
+  // Nothing expired (keys rotated inside one window): evict the oldest entry
+  // — `Map` iterates in insertion order — so the bound always holds.
+  if (buckets.size >= MAX_TRACKED_KEYS) {
+    const oldestKey = buckets.keys().next().value;
+    if (oldestKey !== undefined) buckets.delete(oldestKey);
+  }
+}
+
+/** The subset of Next's `headers()` the address read needs. */
+export interface HeaderReader {
+  get(name: string): string | null;
+}
+
+/**
+ * The visitor's address, coarse: `x-vercel-forwarded-for`, else
+ * `x-forwarded-for`, else `x-real-ip` (first value of each), else
+ * `"unknown"`. Vercel's edge overwrites these with the connecting address;
+ * behind an edge that appends instead, a caller chooses its own key. An
+ * abuse-throttling key only — never an authorization decision.
+ */
+export function clientIpFromHeaders(headers: HeaderReader): string {
+  for (const name of ["x-vercel-forwarded-for", "x-forwarded-for"]) {
+    const value = headers.get(name);
+    if (value) return value.split(",")[0]?.trim() || "unknown";
+  }
+  return headers.get("x-real-ip") || "unknown";
+}

package/templates/content/en/BlogList/blog.mdx

@@ -1,8 +1,8 @@
 ---
 type: "BlogList"
 slug: "blog"
-title: "Get free blog/docs from Fumadocs"
-description: "Or upgrade to Pro and get Fumadocs with our easy-to-use editor."
+title: "{Blog}"
+description: "{One sentence on what you write about}"
 sections:
   [
     {
@@ -13,75 +13,8 @@ sections:
           "variant": "centered",
           "gapBelow": "tight",
           "eyebrow": "Blog",
-          "headline": "Get free blog/docs from Fumadocs",
-          "subheadline": "Or upgrade to Pro and get Fumadocs with our easy-to-use editor.",
-          "primaryCta":
-            { "label": "Get Fumadocs", "href": "https://www.fumadocs.dev" },
-          "secondaryCta":
-            {
-              "label": "Upgrade to Pro",
-              "href": "https://ailaunchkit.ai/pricing",
-              "variant": "outline",
-            },
-        },
-    },
-    {
-      "id": "posts",
-      "type": "blog-list",
-      "data":
-        {
-          "variant": "grid",
-          "posts":
-            [
-              {
-                "title": "Free Fumadocs Blog: publish your blog and docs with Fumadocs",
-                "slug": "post-1",
-                "href": "https://www.fumadocs.dev",
-                "excerpt": "The Free template ships with Fumadocs, the open-source docs and blog engine. Write in Markdown, keep this design system, and publish from your repo.",
-                "publishedAt": "2026-01-01",
-                "readingTime": "5 min",
-              },
-              {
-                "title": "Upgrade to Pro: Fumadocs with our easy-to-use editor",
-                "slug": "post-2",
-                "href": "https://ailaunchkit.ai/pricing",
-                "excerpt": "Upgrade to Pro and write your posts and docs in a visual editor — no Markdown, no repo, the same Fumadocs pages. See what Pro includes.",
-                "publishedAt": "2026-01-02",
-                "readingTime": "5 min",
-              },
-              {
-                "title": "Free Fumadocs Blog: publish your blog and docs with Fumadocs",
-                "slug": "post-3",
-                "href": "https://www.fumadocs.dev",
-                "excerpt": "The Free template ships with Fumadocs, the open-source docs and blog engine. Write in Markdown, keep this design system, and publish from your repo.",
-                "publishedAt": "2026-01-03",
-                "readingTime": "5 min",
-              },
-              {
-                "title": "Upgrade to Pro: Fumadocs with our easy-to-use editor",
-                "slug": "post-4",
-                "href": "https://ailaunchkit.ai/pricing",
-                "excerpt": "Upgrade to Pro and write your posts and docs in a visual editor — no Markdown, no repo, the same Fumadocs pages. See what Pro includes.",
-                "publishedAt": "2026-01-04",
-                "readingTime": "5 min",
-              },
-              {
-                "title": "Free Fumadocs Blog: publish your blog and docs with Fumadocs",
-                "slug": "post-5",
-                "href": "https://www.fumadocs.dev",
-                "excerpt": "The Free template ships with Fumadocs, the open-source docs and blog engine. Write in Markdown, keep this design system, and publish from your repo.",
-                "publishedAt": "2026-01-05",
-                "readingTime": "5 min",
-              },
-              {
-                "title": "Upgrade to Pro: Fumadocs with our easy-to-use editor",
-                "slug": "post-6",
-                "href": "https://ailaunchkit.ai/pricing",
-                "excerpt": "Upgrade to Pro and write your posts and docs in a visual editor — no Markdown, no repo, the same Fumadocs pages. See what Pro includes.",
-                "publishedAt": "2026-01-06",
-                "readingTime": "5 min",
-              },
-            ],
+          "headline": "{Blog}",
+          "subheadline": "{One sentence on what you write about}",
         },
     },
     {

package/templates/content/en/BookCall/book-a-call.mdx

@@ -20,46 +20,6 @@ sections:
           "primaryCta": { "label": "{Get in touch}", "href": "/contact" },
         },
     },
-    {
-      "id": "add-scheduling",
-      "type": "cta",
-      "data":
-        {
-          "variant": "box",
-          "headline": "{What booking a call would do for your visitors}",
-          "description": "{One or two sentences on what live scheduling adds once it's on}",
-          "primaryCta":
-            {
-              "label": "Add scheduling with Pro",
-              "href": "https://ailaunchkit.ai/pricing",
-              "external": true,
-            },
-        },
-    },
-    {
-      "id": "what-happens-on-the-call",
-      "type": "items",
-      "data":
-        {
-          "headline": "What happens on the call?",
-          "columns": 3,
-          "items":
-            [
-              {
-                "title": "{The first thing you cover}",
-                "description": "{One or two sentences on what the visitor learns or decides here}",
-              },
-              {
-                "title": "{The second thing you cover}",
-                "description": "{One or two sentences on what the visitor learns or decides here}",
-              },
-              {
-                "title": "{The next step you agree}",
-                "description": "{One or two sentences on what happens after the call}",
-              },
-            ],
-        },
-    },
     {
       "id": "back-to-meet",
       "type": "content-block",
@@ -77,4 +37,4 @@ sections:
   ]
 ---
 
-{/* Rendered from frontmatter `sections[]` by the /meet/[slug] placeholder route. A template that carries the scheduling module overrides this file with the live booker. The "What happens on the call?" section moved here verbatim from the retired /book-a-call page (#6897 D10). Placeholder copy — replace every {brace} with your own words before you launch. */}
+{/* Rendered from frontmatter `sections[]` by the /meet/[slug] placeholder route. A site that carries the scheduling module renders the hub's meeting page instead, reading this seed only for its URL, its JSON-LD and its fallback title (#8843 C5). Placeholder copy — replace every {brace} with your own words before you launch. */}

package/templates/content/en/BookCall/onsite-estimate.mdx

@@ -20,22 +20,6 @@ sections:
           "primaryCta": { "label": "{Get in touch}", "href": "/contact" },
         },
     },
-    {
-      "id": "add-scheduling",
-      "type": "cta",
-      "data":
-        {
-          "variant": "box",
-          "headline": "{What booking an onsite estimate would do for your visitors}",
-          "description": "{One or two sentences on what live scheduling adds once it's on}",
-          "primaryCta":
-            {
-              "label": "Add scheduling with Pro",
-              "href": "https://ailaunchkit.ai/pricing",
-              "external": true,
-            },
-        },
-    },
     {
       "id": "back-to-meet",
       "type": "content-block",
@@ -53,4 +37,4 @@ sections:
   ]
 ---
 
-{/* Rendered from frontmatter `sections[]` by the /meet/[slug] placeholder route. A template that carries the scheduling module overrides this file with the live booker. Placeholder copy — replace every {brace} with your own words before you launch. */}
+{/* Rendered from frontmatter `sections[]` by the /meet/[slug] placeholder route. A site that carries the scheduling module renders the hub's meeting page instead, reading this seed only for its URL, its JSON-LD and its fallback title (#8843 C5). Placeholder copy — replace every {brace} with your own words before you launch. */}