create-ailk 0.26.0 → 0.28.0

package/templates/apps/web/lib/__tests__/telemetry-scrub.test.ts

@@ -0,0 +1,84 @@
+// #9162 (PR #9152's security review) — the deliverable grant id in the PATH of
+// `<hub>/v1/deliverables/<grantId>`, which `deliverables.openGrant` fetches
+// server-side, is redacted before a URL reaches Sentry. The query-param scrub
+// has its own suite, `__tests__/telemetry-scrub.test.ts`.
+
+import { scrubTelemetryUrl } from "../telemetry-scrub";
+
+const GRANT = "dgrant_01920000-0000-7000-8000-000000000001";
+
+describe("scrubTelemetryUrl — the /v1/deliverables/<grantId> path (#9162)", () => {
+  it("redacts the grant id of an absolute hub URL", () => {
+    expect(
+      scrubTelemetryUrl(`https://hub.example.com/v1/deliverables/${GRANT}`),
+    ).toBe("https://hub.example.com/v1/deliverables/:grantId");
+  });
+
+  it("redacts the grant id of a relative URL", () => {
+    expect(scrubTelemetryUrl(`/v1/deliverables/${GRANT}`)).toBe(
+      "/v1/deliverables/:grantId",
+    );
+  });
+
+  it("keeps the query string and fragment around the redacted id", () => {
+    expect(
+      scrubTelemetryUrl(
+        `https://hub.example.com/v1/deliverables/${GRANT}?x=1#top`,
+      ),
+    ).toBe("https://hub.example.com/v1/deliverables/:grantId?x=1#top");
+  });
+
+  it("redacts the id and strips a token query param together", () => {
+    const out = scrubTelemetryUrl(
+      `https://hub.example.com/v1/deliverables/${GRANT}?g=${GRANT}&x=1`,
+    );
+    expect(out).toBe("https://hub.example.com/v1/deliverables/:grantId?x=1");
+    expect(out).not.toContain(GRANT);
+  });
+
+  it("redacts an id the api-client percent-encoded", () => {
+    const out = scrubTelemetryUrl(
+      `https://hub.example.com/v1/deliverables/${encodeURIComponent("a b%c")}`,
+    );
+    expect(out).toBe("https://hub.example.com/v1/deliverables/:grantId");
+  });
+
+  it("redacts the id under an API base path", () => {
+    expect(
+      scrubTelemetryUrl(`https://hub.example.com/api/v1/deliverables/${GRANT}`),
+    ).toBe("https://hub.example.com/api/v1/deliverables/:grantId");
+  });
+
+  it("redacts the id inside a span description (`METHOD url`)", () => {
+    expect(
+      scrubTelemetryUrl(`GET https://hub.example.com/v1/deliverables/${GRANT}`),
+    ).toBe("GET https://hub.example.com/v1/deliverables/:grantId");
+  });
+
+  it("leaves the ungated open read's slug alone — a slug is not a credential", () => {
+    for (const url of [
+      "https://hub.example.com/v1/deliverables/open/q3",
+      "/v1/deliverables/open/q3?x=1",
+      "GET https://hub.example.com/v1/deliverables/open/q3",
+    ]) {
+      expect(scrubTelemetryUrl(url)).toBe(url);
+    }
+  });
+
+  it("redacts a grant id that only starts with `open`", () => {
+    expect(scrubTelemetryUrl("/v1/deliverables/openly_a_grant")).toBe(
+      "/v1/deliverables/:grantId",
+    );
+  });
+
+  it("leaves other paths unchanged", () => {
+    for (const url of [
+      "https://hub.example.com/v1/deliverables",
+      "https://hub.example.com/v1/deliverables/",
+      "/v1/leads/submit",
+      `/reports/q3/file`,
+    ]) {
+      expect(scrubTelemetryUrl(url)).toBe(url);
+    }
+  });
+});

package/templates/apps/web/lib/__tests__/template-listing.test.ts

@@ -0,0 +1,158 @@
+/**
+ * The template-listing mapping (#10051 D6, AC-6) — a TemplatePage's
+ * frontmatter to a hub card, an action label and the detail page's
+ * generated sections. Pure; no I/O.
+ */
+import { PageSectionsSchema } from "@working-theory/validation";
+
+import {
+  templateActionLabel,
+  templateCard,
+  templateDetailSections,
+  type TemplateLabels,
+} from "../template-listing";
+
+const labels: TemplateLabels = {
+  getIt: "Get it",
+  startFree: "Start free",
+  viewDemo: "View demo",
+  viewTemplate: "View template",
+  included: "What's included",
+  demoBadge: "Live demo",
+  moreCategories: (count) => `+${count} more`,
+};
+
+const full = {
+  slug: "a",
+  frontmatter: {
+    title: "Template A",
+    description: "Description A.",
+    summary: "Summary A.",
+    thumbnail: "/img/a.png",
+    categories: ["accounting", "not-a-category", "legal"],
+    demoUrl: "https://a.salessmyth.com",
+    getItUrl: "/contact",
+    price: 0,
+    includes: [
+      { title: "Base site", description: "Pages and structured data." },
+    ],
+  },
+};
+
+const bare = {
+  slug: "b",
+  frontmatter: {
+    title: "Template B",
+    description: "Description B.",
+    getItUrl: "https://buy.example.com/b",
+    includes: [
+      { title: "Base site", description: "Pages and structured data." },
+    ],
+  },
+};
+
+describe("templateCard", () => {
+  it("maps every present field", () => {
+    expect(templateCard(full, labels)).toEqual({
+      title: "Template A",
+      description: "Summary A.",
+      image: { src: "/img/a.png", alt: "Template A" },
+      eyebrow: "Accounting · Legal",
+      badge: "Live demo",
+      link: { label: "View template", href: "/templates/a" },
+    });
+  });
+
+  it("omits image, eyebrow and badge when their fields are absent, and falls back to description", () => {
+    expect(templateCard(bare, labels)).toEqual({
+      title: "Template B",
+      description: "Description B.",
+      link: { label: "View template", href: "/templates/b" },
+    });
+  });
+
+  it("omits the eyebrow when every category slug is unknown", () => {
+    const card = templateCard(
+      { slug: "c", frontmatter: { ...bare.frontmatter, categories: ["nope"] } },
+      labels,
+    );
+    expect(card).not.toHaveProperty("eyebrow");
+  });
+
+  it("shows at most three category names, then +N more", () => {
+    const card = templateCard(
+      {
+        slug: "d",
+        frontmatter: {
+          ...bare.frontmatter,
+          categories: ["accounting", "legal", "consulting", "hvac", "roofing"],
+        },
+      },
+      labels,
+    );
+    expect(card.eyebrow).toBe("Accounting · Legal · Consulting · +2 more");
+  });
+});
+
+describe("templateActionLabel", () => {
+  it("is Start free only for a price of exactly 0", () => {
+    expect(templateActionLabel(0, labels)).toBe("Start free");
+    expect(templateActionLabel(undefined, labels)).toBe("Get it");
+    expect(templateActionLabel(5, labels)).toBe("Get it");
+  });
+});
+
+describe("templateDetailSections", () => {
+  it("builds a hero and a What's included section", () => {
+    const [hero, included] = templateDetailSections(full.frontmatter, labels);
+    expect(hero).toMatchObject({
+      type: "hero",
+      data: {
+        headline: "Template A",
+        subheadline: "Summary A.",
+        eyebrow: "Accounting · Legal",
+        image: { src: "/img/a.png", alt: "Template A" },
+        primaryCta: { label: "Start free", href: "/contact" },
+        secondaryCta: {
+          label: "View demo",
+          href: "https://a.salessmyth.com",
+          variant: "outline",
+        },
+      },
+    });
+    expect(included).toEqual({
+      type: "items",
+      id: "template-included",
+      data: {
+        headline: "What's included",
+        variant: "minimal",
+        items: [
+          { title: "Base site", description: "Pages and structured data." },
+        ],
+      },
+    });
+  });
+
+  it("omits the demo link, image and eyebrow when absent", () => {
+    const [hero] = templateDetailSections(bare.frontmatter, labels);
+    const data = (hero as { data: Record<string, unknown> }).data;
+    expect(data.primaryCta).toEqual({
+      label: "Get it",
+      href: "https://buy.example.com/b",
+    });
+    expect(data).not.toHaveProperty("secondaryCta");
+    expect(data).not.toHaveProperty("image");
+    expect(data).not.toHaveProperty("eyebrow");
+    expect(data.subheadline).toBe("Description B.");
+  });
+
+  it.each([
+    ["full", full.frontmatter],
+    ["bare", bare.frontmatter],
+  ])("the %s result parses PageSectionsSchema", (_label, frontmatter) => {
+    expect(
+      PageSectionsSchema.safeParse(templateDetailSections(frontmatter, labels))
+        .success,
+    ).toBe(true);
+  });
+});

package/templates/apps/web/lib/auth-secret.ts

@@ -0,0 +1,57 @@
+/**
+ * auth-secret.ts — `resolveSecret()`, moved verbatim out of `auth.ts`
+ * (#8556, spec docs/specs/9965-sweep-a-trust-or-authz-spec.md D7) so a
+ * consumer that only needs the secret does not load Better Auth, which is
+ * ESM-only. `auth.ts` re-exports it, so every existing import is unchanged.
+ */
+
+/**
+ * Resolve the secret used to sign session cookies AND — since #5962 § D9 — the
+ * email-verification JWTs.
+ *
+ * THROWS in production when BETTER_AUTH_SECRET is unset (§ D16). Better Auth's
+ * own `validateSecret` throws only when the secret equals ITS default; this
+ * repo's literal is a different string, so it cleared that check and produced
+ * nothing but a low-entropy warning — while sitting in a repository whose
+ * `oss`-tier tree ships publicly. Anyone who can read this file could forge
+ * both a session cookie and a verification token on any deployment that
+ * omitted the variable.
+ *
+ * This changes boot behaviour: a production deployment with no
+ * BETTER_AUTH_SECRET boots today and does not after this. That is the correct
+ * failure — a site signing sessions with a published string is not usefully
+ * "up" — and `apps/web/.env.example` has always documented the variable as
+ * REQUIRED in production. The change makes the file honest rather than adding
+ * a requirement.
+ *
+ * Exported (#8146 D5) so the hub's sign-in continuation seals its ref under the
+ * same resolved secret instead of re-reading the variable: the second consumer
+ * after `betterAuth({ secret })`.
+ */
+export function resolveSecret(): string {
+  const configured = process.env.BETTER_AUTH_SECRET;
+  if (configured) return configured;
+
+  // SERVING, not BUILDING. `next build` collects page data with
+  // NODE_ENV=production, and that evaluates `app/api/auth/[...all]/route.ts`,
+  // which resolves the lazy `auth` proxy — so an unqualified production throw
+  // fails the BUILD of any tree that has not set the variable. That is much
+  // broader than the risk: a build produces an artifact, it does not serve a
+  // session, and it would break CI, preview builds, and `pnpm build` on a
+  // freshly scaffolded site that has not configured auth at all.
+  //
+  // Next sets NEXT_PHASE to PHASE_PRODUCTION_BUILD ("phase-production-build")
+  // for the duration of the build, so excluding that phase keeps the guard
+  // exactly where it was aimed: a production process that is about to answer
+  // requests. Such a process still throws on the first access to `auth`, which
+  // is the intended failure — a site signing sessions with a string published
+  // in this repository is not usefully "up".
+  const isBuildPhase = process.env.NEXT_PHASE === "phase-production-build";
+  if (process.env.NODE_ENV === "production" && !isBuildPhase) {
+    throw new Error(
+      "BETTER_AUTH_SECRET is required in production: it signs session cookies and email-verification tokens, and the development fallback is published in this repository.",
+    );
+  }
+
+  return "ailk-dev-fallback-secret-published-in-this-repo-never-use-in-production";
+}

package/templates/apps/web/lib/bot-check.ts

@@ -0,0 +1,138 @@
+/**
+ * The spoke edge's one bot check (#9889, #9255, spec
+ * docs/specs/9255-an-edge-bot-challenge-in-spec.md).
+ *
+ * Vercel BotID's verdict on a public write, asked on this site's own server
+ * before the hub is called: by the relay for its checked pairs (`relay.ts`'s
+ * `BOT_CHECKED_ROUTES`) and by each public lead, flow and checkout Server
+ * Action immediately before its hub call. MCP tools and key-bearing API calls
+ * never pass through a site, so they are never challenged.
+ *
+ * It fails closed (#9889 D3): only `isBot === false` passes. A bot is `bot`;
+ * a check that throws, answers no boolean or takes over 5 seconds is
+ * `unavailable`. It runs only on Vercel (`VERCEL=1`); `AILK_BOT_CHECK=off`
+ * turns every check off and `AILK_BOOKING_BOT_CHECK=off` the booking's alone.
+ *
+ * NO SECRET IS LOGGED. A refusal logs `{ path, outcome }` and, for a failed
+ * check, the error's name — never its message.
+ */
+import { checkBotId } from "botid/server";
+
+export type BotCheckScope = "write" | "booking";
+export type BotCheckOutcome = "pass" | "bot" | "unavailable";
+
+/**
+ * BotID's browser `protect` list: every same-origin POST. A Server Action
+ * posts to the URL of the page it was submitted from (the footer's newsletter
+ * signup is on every page), and a checked request the client did not protect
+ * carries no challenge header and is refused as a bot.
+ */
+export const BOT_CLIENT_PROTECT = Object.freeze([
+  Object.freeze({ path: "/*", method: "POST" }),
+]) as { path: string; method: string }[];
+
+/** The longest a check waits for a verdict; the library's own fetch has no bound. */
+const BOT_CHECK_TIMEOUT_MS = 5_000;
+
+/** Unset, empty or any other value leaves a check on, so a typo fails toward protection. */
+function isOff(value: string | undefined): boolean {
+  return value?.trim().toLowerCase() === "off";
+}
+
+function switchedOff(scope: BotCheckScope): boolean {
+  return (
+    isOff(process.env.AILK_BOT_CHECK) ||
+    (scope === "booking" && isOff(process.env.AILK_BOOKING_BOT_CHECK))
+  );
+}
+
+/** True when the check runs for `scope`. Read on every call, never cached. */
+export function botCheckOn(scope: BotCheckScope): boolean {
+  return process.env.VERCEL === "1" && !switchedOff(scope);
+}
+
+let warnedBotCheckInactive = false;
+
+/**
+ * Called when the check is off. Off Vercel it cannot run (#9889 D2): a
+ * production site whose switch is not `off` logs that once per process, so an
+ * owner who believes it is on can find out. It never refuses.
+ */
+function warnBotCheckInactiveOnce(scope: BotCheckScope): void {
+  if (warnedBotCheckInactive || process.env.NODE_ENV !== "production") return;
+  if (switchedOff(scope)) return;
+  warnedBotCheckInactive = true;
+  console.warn("[relay] booking bot check inactive", {
+    outcome: "not-on-vercel",
+  });
+}
+
+function namedError(name: string): Error {
+  const err = new Error(name);
+  err.name = name;
+  return err;
+}
+
+/**
+ * BotID's verdict on this request: `true` for a bot, `false` for a human.
+ * Throws `TimeoutError` past `BOT_CHECK_TIMEOUT_MS` and `InvalidVerdictError`
+ * when `isBot` is not a boolean, as `checkBotId` returns for an error answer
+ * from Vercel.
+ */
+async function isBotVerdict(): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const verdict = await Promise.race([
+      checkBotId(),
+      new Promise<never>((_resolve, reject) => {
+        timer = setTimeout(
+          () => reject(namedError("TimeoutError")),
+          BOT_CHECK_TIMEOUT_MS,
+        );
+      }),
+    ]);
+    const isBot = (verdict as { isBot?: unknown } | undefined)?.isBot;
+    if (typeof isBot !== "boolean") throw namedError("InvalidVerdictError");
+    return isBot;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * The check for one write. `source` names the log prefix and `target` the
+ * relayed path or the action's name — never a field value. Never throws.
+ */
+export async function runBotCheck({
+  source,
+  target,
+  scope,
+}: {
+  source: string;
+  target: string;
+  scope: BotCheckScope;
+}): Promise<BotCheckOutcome> {
+  if (!botCheckOn(scope)) {
+    warnBotCheckInactiveOnce(scope);
+    return "pass";
+  }
+  let isBot: boolean;
+  try {
+    isBot = await isBotVerdict();
+  } catch (err) {
+    console.error(`[${source}] bot check failed`, {
+      path: target,
+      outcome: "bot-check-failed",
+      error: err instanceof Error ? err.name : "unknown",
+    });
+    return "unavailable";
+  }
+  if (isBot) {
+    console.warn(`[${source}] bot refused`, {
+      path: target,
+      outcome: "bot-detected",
+    });
+    return "bot";
+  }
+  return "pass";
+}

package/templates/apps/web/lib/consent-visitor.ts

@@ -10,9 +10,43 @@
  *
  * httpOnly, `Secure` in production, `SameSite=Lax`, path `/`, one year — a
  * Server Action can read and mint it; client script never sees its value.
+ *
+ * The cookie is `<uuid>.<sig>`, signed by this site (#8556, spec
+ * docs/specs/9965-sweep-a-trust-or-authz-spec.md D7): `sig` is the base64url
+ * HMAC-SHA256 of the UUID under a subkey derived from the site's own secret
+ * with a fixed label, so that secret is never used raw for a second purpose.
+ * A read returns the bare UUID only when the signature verifies, so a visitor
+ * id the browser made up is never forwarded as `x-ailk-consent-visitor`.
+ *
+ * The secret is one the site already holds, taken in this fixed order
+ * (operator decision on #9965, option (b)):
+ *
+ *   1. `BETTER_AUTH_SECRET`, via `resolveSecret()` — a hub, or any site that
+ *      builds Better Auth;
+ *   2. `AILK_HUB_SESSION_SECRET` — a spoke that signs in through its hub;
+ *   3. `AILK_SPOKE_KEY` — any other spoke;
+ *
+ * each of 2 and 3 only at 32 characters or more once trimmed (the floor
+ * `hub-session/config.ts` sets; a minted spoke key is longer), so a short
+ * value a visitor could brute-force from their own cookie is never a key;
+ *   4. otherwise `resolveSecret()` again, which is the development fallback
+ *      outside production and THROWS in a production process.
+ *
+ * So a production spoke, which create-ailk deliberately gives no
+ * `BETTER_AUTH_SECRET`, still signs and verifies its own ids. With none of
+ * the three set a read is `undefined` and a mint throws, so nothing unsigned
+ * is ever written or forwarded (fail closed). A verifier recomputes the
+ * signature under its own secret, so it accepts only what its own site signed.
  */
 
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+import { resolveSecret } from "./auth-secret";
+
 const CONSENT_VISITOR_COOKIE_NAME = "ailk-vid";
+const SIGNING_LABEL = "ailk-consent-visitor-v1";
+/** The shortest spoke-held secret this module signs with. */
+const MIN_FALLBACK_SECRET_LENGTH = 32;
 const ONE_YEAR_SECONDS = 60 * 60 * 24 * 365;
 
 const V4_UUID =
@@ -23,6 +57,42 @@ export function isValidConsentVisitorId(value: string): boolean {
   return V4_UUID.test(value);
 }
 
+/** The site's own signing secret, in the order the header documents. */
+function signingSecret(): string {
+  if (process.env.BETTER_AUTH_SECRET) return resolveSecret();
+  const fallback = [process.env.AILK_HUB_SESSION_SECRET, process.env.AILK_SPOKE_KEY]
+    .map((value) => value?.trim() ?? "")
+    .find((value) => value.length >= MIN_FALLBACK_SECRET_LENGTH);
+  return fallback ?? resolveSecret();
+}
+
+/** The base64url signature of `id`. Throws when no secret is set in production. */
+function sign(id: string): string {
+  const subkey = createHmac("sha256", signingSecret()).update(SIGNING_LABEL).digest();
+  return createHmac("sha256", subkey).update(id).digest("base64url");
+}
+
+/**
+ * The UUID a signed cookie value carries, or `undefined` for a bare UUID, a
+ * bad or wrong-length signature, or a secret that cannot be resolved.
+ */
+function verifiedId(value: string): string | undefined {
+  const dot = value.indexOf(".");
+  if (dot === -1) return undefined;
+  const id = value.slice(0, dot);
+  if (!isValidConsentVisitorId(id)) return undefined;
+  let expected: Buffer;
+  try {
+    expected = Buffer.from(sign(id));
+  } catch {
+    return undefined;
+  }
+  const presented = Buffer.from(value.slice(dot + 1));
+  // timingSafeEqual throws on unequal lengths, so that is checked first.
+  if (presented.length !== expected.length) return undefined;
+  return timingSafeEqual(presented, expected) ? id : undefined;
+}
+
 /** The subset of Next's `cookies()` jar a read needs. */
 export interface ConsentVisitorCookieReader {
   get(name: string): { value: string } | undefined;
@@ -50,16 +120,21 @@ export interface ConsentVisitorCookieWriter extends ConsentVisitorCookieReader {
   set(name: string, value: string, options: ConsentVisitorCookieOptions): void;
 }
 
-/** The existing visitor id, or `undefined` with none set or an invalid value. */
+/**
+ * The existing visitor id, or `undefined` with none set or a value whose
+ * signature does not verify.
+ */
 export function readConsentVisitor(
   cookies: ConsentVisitorCookieReader,
 ): string | undefined {
   const value = cookies.get(CONSENT_VISITOR_COOKIE_NAME)?.value;
-  return value !== undefined && isValidConsentVisitorId(value) ? value : undefined;
+  return value !== undefined ? verifiedId(value) : undefined;
 }
 
 /**
- * The visitor id, minting and setting a fresh one when absent or invalid.
+ * The visitor id, minting and setting a fresh signed one when absent or when
+ * the stored value does not verify (a cookie minted before signing included).
+ * Throws, setting nothing, when a production site holds none of the secrets.
  * Server Actions only — Next refuses a cookie write outside one (the same
  * posture `hub-session/reseal.ts` documents).
  */
@@ -67,7 +142,7 @@ export function ensureConsentVisitor(cookies: ConsentVisitorCookieWriter): strin
   const existing = readConsentVisitor(cookies);
   if (existing !== undefined) return existing;
   const id = crypto.randomUUID();
-  cookies.set(CONSENT_VISITOR_COOKIE_NAME, id, {
+  cookies.set(CONSENT_VISITOR_COOKIE_NAME, `${id}.${sign(id)}`, {
     httpOnly: true,
     secure: process.env.NODE_ENV === "production",
     sameSite: "lax",
@@ -85,7 +160,7 @@ export function consentVisitorHeader(id: string): Record<string, string> {
 /**
  * The visitor id out of a raw `Cookie:` header string (the relay's own
  * `Request`, which carries no Next `cookies()` jar). `undefined` with no
- * header, no matching cookie, or a value that fails the UUID shape.
+ * header, no matching cookie, or a value whose signature does not verify.
  */
 export function readConsentVisitorFromCookieHeader(
   header: string | null | undefined,
@@ -96,8 +171,7 @@ export function readConsentVisitorFromCookieHeader(
     if (eq === -1) continue;
     const name = part.slice(0, eq).trim();
     if (name !== CONSENT_VISITOR_COOKIE_NAME) continue;
-    const value = part.slice(eq + 1).trim();
-    return isValidConsentVisitorId(value) ? value : undefined;
+    return verifiedId(part.slice(eq + 1).trim());
   }
   return undefined;
 }

package/templates/apps/web/lib/deck-page.ts

@@ -42,11 +42,14 @@ export const DECK_ROUTES = [
   "/faq",
   "/launch-service",
   "/pricing",
+  "/pricing/:slug",
   "/privacy",
   "/projects",
   "/projects/:slug",
   "/purchase-policy",
   "/reports",
+  "/templates",
+  "/templates/:slug",
   "/terms",
   "/thanks/:slug",
   "/working-agreement",
@@ -65,7 +68,7 @@ function routeSegments(route: string): string[] {
   return route.split("/").filter((segment) => segment.length > 0);
 }
 
-function matchesRoute(routeDef: string, pathSegments: readonly string[]): boolean {
+export function matchesRoute(routeDef: string, pathSegments: readonly string[]): boolean {
   const defSegments = routeSegments(routeDef);
   if (defSegments.length !== pathSegments.length) return false;
   return defSegments.every(
@@ -74,7 +77,7 @@ function matchesRoute(routeDef: string, pathSegments: readonly string[]): boolea
 }
 
 /** The type and slug a matched routes-map row resolves to for this request. */
-function resolveTypeAndSlug(
+export function resolveTypeAndSlug(
   row: RouteRow,
   routeDef: string,
   pathSegments: readonly string[],
@@ -94,7 +97,7 @@ function resolveTypeAndSlug(
 }
 
 /** Whether a routes-map row at this exact route is always scaffolded (never absent from a site). */
-function isAlwaysScaffolded(path: string): boolean {
+export function isAlwaysScaffolded(path: string): boolean {
   const row = ROUTES.find((candidate) => candidate.route === path);
   return row !== undefined && row.gateable !== true && row.module === "marketing";
 }