create-ailk 0.22.0 → 0.24.0

package/templates/apps/web/lib/__tests__/structured-data.test.tsx

@@ -45,6 +45,7 @@ import {
 import {
   getPageSections,
   pageToJsonLd,
+  siteOrigin,
   type JsonLdObject,
 } from "@working-theory/page-renderer";
 import {
@@ -110,6 +111,13 @@ if (process.env.AILK_CONTENT_ROOT === undefined) {
   process.env.AILK_CONTENT_ROOT = CONTENT_ROOT;
 }
 
+// A page that checks its own locale (`lib/locale-guard`, the meeting page)
+// reads the enabled list next.config.mjs bakes in; pin it to the locale this
+// file renders, as a built app would carry it.
+if (process.env.NEXT_PUBLIC_ENABLED_LOCALES === undefined) {
+  process.env.NEXT_PUBLIC_ENABLED_LOCALES = DEFAULT_LOCALE;
+}
+
 // Mirrors the locale-directory rule in tools/content-compile and the adapter.
 const LOCALE_RE = /^[a-z]{2}(-[A-Z]{2})?$/;
 
@@ -194,11 +202,8 @@ function extractJsonLdBlocks(container: HTMLElement): JsonLdObject[] {
 }
 
 const SITE_IDENTITY = readSiteIdentity(CONTENT_ROOT);
-const SITE_ORIGIN = (
-  process.env.NEXT_PUBLIC_SITE_URL ??
-  process.env.MARKETING_WEB_BASE_URL ??
-  "http://localhost:3000"
-).replace(/\/+$/, "");
+// The resolver's own origin chain (#8797 D5), so this check cannot drift from it.
+const SITE_ORIGIN = siteOrigin(SITE_IDENTITY);
 
 /**
  * The sitewide identity trio every rendered page carries when the site's own
@@ -305,6 +310,16 @@ const CHECKOUT_PAGE_MARKER = "Standard spoke checkout page (#8748)";
 // record), so its updated copy of this test must still exempt them.
 const LEGACY_CHECKOUT_PAGE_MARKER = "GENERATED by create-ailk (#7838)";
 const CHECKOUT_PAGE_NOINDEX_LINE = "robots: { index: false, follow: false }";
+// #8840 D13 — the marker every standard magnet page carries in its header
+// comment (`apps/web/app/[locale]/flows/[slug]/magnet-page.tsx`), and the
+// renderer it must import. A magnet page renders no `renderPage` call this
+// harness can read, and its landing's JSON-LD comes from the hub's record, so
+// a page carrying both is exempt at ANY route: `create-ailk add-route magnet`
+// writes a pair at a path the site picks. Keyed on the file, as #8513 is.
+const MAGNET_PAGE_MARKER = "Standard magnet page (#8840)";
+const MAGNET_RENDERER_IMPORT = "flows/[slug]/magnet-page";
+const MAGNET_PAGE_REASON =
+  "standard magnet page (#8840) — rendered by flows/[slug]/magnet-page; its landing's JSON-LD comes from the hub's flow record";
 
 const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
   route: string;
@@ -325,12 +340,12 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
   // harness. Not checked here.
   {
     route: "blog",
-    reason: "fumadocs route — emits via @working-theory/fumadocs-schema",
+    reason: "fumadocs route — its .source collection is not built in this harness",
     subtree: true,
   },
   {
     route: "docs",
-    reason: "fumadocs route — emits via @working-theory/fumadocs-schema",
+    reason: "fumadocs route — its .source collection is not built in this harness",
     subtree: true,
   },
   // Hub routes that enumerate a detail type with no list page type of their
@@ -340,6 +355,10 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
     route: "how-to",
     reason: "hand-composed listing; no HowTo list type exists",
   },
+  {
+    route: "careers/[slug]/[action]",
+    reason: "the Free apply form for a posting; noindex, no JSON-LD (#8849 D7)",
+  },
   {
     route: "software",
     reason: "hand-composed listing; no SoftwareProduct list type exists",
@@ -368,11 +387,23 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
     reason: "interactive flow engine, API-backed",
     subtree: true,
   },
-  { route: "meet", reason: "booking surface, API-backed", subtree: true },
+  // #8843 D7 — the meeting page `meet/[slug]` composes its own body from a
+  // `BookCall` seed (`getMdxSource` + `pageToJsonLd`), so it is checked like
+  // any route; the two indexes and the confirmation page are not pages.
+  { route: "meet", reason: "booking index, API-backed (#8843 D8)" },
+  { route: "meet/confirmed", reason: "booking confirmation, API-backed" },
+  { route: "private", reason: "private booking index, API-backed and noindex (#8843 D8)" },
   {
     route: "unsubscribe",
     reason: "app-shaped landing, API-backed; no content page behind it",
   },
+  // #8848 D12 — `/downloads` and `/downloads/<slug>` are permanent redirects
+  // into `/reports`; a redirect renders no page.
+  {
+    route: "downloads",
+    reason: "permanent redirect into /reports (#8848 D12); renders no page",
+    subtree: true,
+  },
   // #6084 — both purchase return pages read a Checkout Session (or read
   // nothing, for cancel) and render via SectionRenderer directly; neither
   // is a content-adapter page, and the paid render's own schema.org node
@@ -440,6 +471,9 @@ function walkRoutes(dir: string, out: RouteEntry[] = []): RouteEntry[] {
 }
 
 function exemption(route: string, src: string): string | undefined {
+  if (src.includes(MAGNET_PAGE_MARKER) && src.includes(MAGNET_RENDERER_IMPORT)) {
+    return MAGNET_PAGE_REASON;
+  }
   const entry = NO_STRUCTURED_DATA_ROUTES.find(
     (e) =>
       route === e.route ||
@@ -678,6 +712,31 @@ describe("structured data — exemption(route, src) keys the generated checkout
   });
 });
 
+// ── 2b. exemption(route, src) — the standard magnet pages (#8840 D13) ────
+
+describe("structured data — exemption(route, src) keys a standard magnet page on the file (#8840)", () => {
+  // The import line is assembled, not written out, so this file's own text
+  // carries no import of a path a scaffold's copy of it may not ship.
+  const IMPORT_LINE = ["import { magnetLanding } from ", JSON.stringify(`../${MAGNET_RENDERER_IMPORT}`), ";"].join("");
+  const PAIR_SRC = `// Generated by create-ailk add-route magnet.\n// ${MAGNET_PAGE_MARKER} — the landing of the /diagnostic magnet pair.\n${IMPORT_LINE}\n`;
+
+  it("exempts a page carrying the marker and the renderer import, at any route", () => {
+    expect(exemption("diagnostic", PAIR_SRC)).toBe(MAGNET_PAGE_REASON);
+    expect(exemption("diagnostic/start", PAIR_SRC)).toBe(MAGNET_PAGE_REASON);
+    expect(exemption("careers/writer", PAIR_SRC)).toBe(MAGNET_PAGE_REASON);
+  });
+
+  it("checks a page carrying the marker but no import of the renderer like any other", () => {
+    const noImport = `// ${MAGNET_PAGE_MARKER}\nexport default function Page() { return null; }\n`;
+    expect(exemption("diagnostic", noImport)).toBeUndefined();
+  });
+
+  it("checks a page importing the renderer without the marker like any other", () => {
+    const noMarker = `${IMPORT_LINE}\n`;
+    expect(exemption("diagnostic", noMarker)).toBeUndefined();
+  });
+});
+
 // ── 3. The two defect shapes that shipped, pinned ───────────────────────────
 //
 // These prove the checks above reach the validator rule that rejects each

package/templates/apps/web/lib/auth-routes.ts

@@ -12,6 +12,12 @@
  * signed-in account area — `/account` and everything under it — which the
  * layout also renders without the marketing chrome.
  *
+ * `isBookingPath()` (#8843 D10) is the same predicate for the scheduling
+ * module's booking pages — `/meet`, `/meet/<slug>` and `/private`, never
+ * `/meet/confirmed` — which the layout renders chrome-free only where the
+ * module is installed (`lib/modules.generated.ts`). This module imports
+ * nothing, so edge code can import it too.
+ *
  * No Next.js import — pure functions, asserted directly by their own suite.
  */
 
@@ -62,6 +68,21 @@ export function isAccountPath(
   return firstSegment(pathname, locales) === "account";
 }
 
+/**
+ * Whether `pathname` addresses a booking page: `/private`, `/meet`, or
+ * `/meet/<slug>` for any slug but `confirmed` (the booker's confirmation
+ * page, which keeps the marketing chrome). The same prefix rule and the same
+ * fail-safe direction as `isAuthPath()`.
+ */
+export function isBookingPath(
+  pathname: string | undefined | null,
+  locales: readonly string[],
+): boolean {
+  const [first, second] = segments(pathname, locales);
+  if (first === "private") return true;
+  return first === "meet" && second !== "confirmed";
+}
+
 /**
  * The first path segment after an enabled-locale prefix, or `undefined` for
  * an absent or empty pathname.
@@ -70,7 +91,18 @@ function firstSegment(
   pathname: string | undefined | null,
   locales: readonly string[],
 ): string | undefined {
-  if (!pathname) return undefined;
+  return segments(pathname, locales)[0];
+}
+
+/**
+ * The path's segments after an enabled-locale prefix (empty for an absent or
+ * empty pathname). A trailing slash adds no segment.
+ */
+function segments(
+  pathname: string | undefined | null,
+  locales: readonly string[],
+): string[] {
+  if (!pathname) return [];
 
   // Drop a query string / fragment — `x-pathname` carries the path, but a
   // caller passing a full request path should get the same verdict.
@@ -80,5 +112,7 @@ function firstSegment(
       ? path.replace(new RegExp(`^/(${locales.join("|")})(?=/|$)`), "")
       : path;
 
-  return bare.split("/")[1];
+  const parts = bare.split("/").slice(1);
+  if (parts.at(-1) === "") parts.pop();
+  return parts;
 }

package/templates/apps/web/lib/checkout-config.ts

@@ -1,27 +1,16 @@
-// checkout-config.ts — this spoke's checkout, as data (#7838, #8748).
+// checkout-config.ts — this spoke's checkout stamp, as data (#7838, #8748).
 //
-// The one checkout file this site edits. Written once by create-ailk and yours
-// from then on: `create-ailk update` never rewrites it. The standard checkout
-// (lib/checkout.ts, the buy route and the Stripe webhook route) reads only
-// `site` and `offerings` from it and is kept current by `create-ailk update`.
-// Keep it to data: no import, and no code.
+// Written once by create-ailk and yours from then on: `create-ailk update`
+// never rewrites it. Keep it to data: no import, and no code. A spoke sells
+// through its hub's Offerings buy route, /api/offerings/checkout/<lookup_key>
+// (#9142); the thank-you page and, on a spoke that signs in through its hub,
+// the billing action read `site` from here.
 //
-// site       Stamped on every Checkout Session as metadata.site. This site's
-//            webhook acts only on its own stamp, and the hub ignores any stamp
-//            that is not its own, so the stamp must be unique on the Stripe
-//            account this site shares. Never "default". Change it only before
-//            any price exists: every lookup key starts with it.
-// offerings  slug -> Stripe lookup_key. The buy link is /api/checkout/<slug>,
-//            and any other slug answers 404. Name an offering's slug after the
-//            last segment of the Service or Product page that sells it: that
-//            is the key the hub's plan rule and a magnet's checkoutOffering
-//            use. scaffold-commerce replaces the placeholder below.
+// site       The paid-session stamp the thank-you page checks
+//            (`metadata.site`) before it prefills "Open your account". Never
+//            "default". The create-ailk writer stamps the line below.
 const SITE = "example-site";
 
 export const checkoutConfig = {
   site: SITE,
-  offerings: {
-    // A placeholder until scaffold-commerce creates this site's prices.
-    example: { kind: "fixed", lookupKey: `${SITE}_example`, cancelPath: "/" },
-  },
 };

package/templates/apps/web/lib/deck-page.ts

@@ -37,6 +37,7 @@ import { siteChrome, type SiteChrome } from "./site-chrome";
 export const DECK_ROUTES = [
   "/about",
   "/alternatives",
+  "/careers",
   "/contact",
   "/faq",
   "/launch-service",

package/templates/apps/web/lib/deliverable-grant.ts

@@ -0,0 +1,18 @@
+/**
+ * The shape a deliverable grant id must match before anything spends a hub
+ * call on it (#9125). One definition, read by the report page
+ * (`app/[locale]/reports/[slug]/page.tsx`, `resolveGrantId`) and its file
+ * route (`app/[locale]/reports/[slug]/file/route.ts`), so the page and the
+ * bytes can never disagree on which ids are worth probing.
+ *
+ * A grant id is minted as `dgrant_<uuidv7>` (database/inbox/schema.prisma).
+ * This is deliberately a charset-and-length check, not a `dgrant_` prefix
+ * match: the API stays the authority on which ids are real, and a future id
+ * scheme should not need an edit here. 128 is a generous ceiling over today's
+ * `dgrant_<uuid>`.
+ *
+ * Deliberately base-tree, not slice-owned: a keyed scaffold's
+ * signal-collectors bundle installs the page and route that import it, so it
+ * must already be in every scaffold.
+ */
+export const GRANT_ID_SHAPE = /^[A-Za-z0-9_-]{1,128}$/;