create-ailk 0.27.0 → 0.28.0

package/templates/apps/web/lib/__tests__/consent-visitor.test.ts

@@ -1,7 +1,9 @@
 /**
  * Tests for consent-visitor.ts (the `ailk-vid` cookie helpers) and for
  * `acceptCookiesAction`/`declineCookiesAction` (#8438 D12,
- * `app/[locale]/consent.actions.ts`) — the banner's one write path.
+ * `app/[locale]/consent.actions.ts`) — the banner's one write path. The
+ * cookie is signed by the site (#8556, spec 9965 D7): a read returns the UUID
+ * only when the signature verifies.
  */
 import {
   consentVisitorHeader,
@@ -13,6 +15,72 @@ import {
 
 const VALID_ID = "11111111-2222-4333-8444-555555555555";
 
+/** The cookie value `ensureConsentVisitor` writes, captured from a real mint. */
+function mintedCookie(): { id: string; value: string } {
+  const set = jest.fn();
+  const id = ensureConsentVisitor({ get: () => undefined, set });
+  return { id, value: set.mock.calls[0][1] as string };
+}
+
+/** `value` with the signature's first character changed (the last carries padding bits). */
+function tampered(value: string): string {
+  const at = value.indexOf(".") + 1;
+  return `${value.slice(0, at)}${value[at] === "A" ? "B" : "A"}${value.slice(at + 1)}`;
+}
+
+/** The env keys the signing secret is chosen from, and the two that decide whether a missing one throws. */
+const SECRET_ENV_KEYS = [
+  "NODE_ENV",
+  "NEXT_PHASE",
+  "BETTER_AUTH_SECRET",
+  "AILK_HUB_SESSION_SECRET",
+  "AILK_SPOKE_KEY",
+] as const;
+
+/**
+ * Run `fn` with exactly `vars` set among `SECRET_ENV_KEYS` (the rest unset),
+ * restoring every one of them after.
+ */
+function withEnv<T>(
+  vars: Partial<Record<(typeof SECRET_ENV_KEYS)[number], string>>,
+  fn: () => T,
+): T {
+  const saved = Object.fromEntries(SECRET_ENV_KEYS.map((key) => [key, process.env[key]]));
+  const restore = () => {
+    for (const [key, value] of Object.entries(saved)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  };
+  for (const key of SECRET_ENV_KEYS) delete process.env[key];
+  Object.assign(process.env, vars);
+  let result: T;
+  try {
+    result = fn();
+  } catch (err) {
+    restore();
+    throw err;
+  }
+  if (result instanceof Promise) return result.finally(restore) as T;
+  restore();
+  return result;
+}
+
+/** Run `fn` as a production process holding none of the three secrets. */
+function withoutSecret<T>(fn: () => T): T {
+  return withEnv({ NODE_ENV: "production" }, fn);
+}
+
+/** A cookie value minted under `vars`, read back under `readVars`. */
+function mintThenRead(
+  vars: Parameters<typeof withEnv>[0],
+  readVars: Parameters<typeof withEnv>[0],
+): { id: string; read: string | undefined } {
+  const { id, value } = withEnv(vars, mintedCookie);
+  const read = withEnv(readVars, () => readConsentVisitor({ get: () => ({ value }) }));
+  return { id, read };
+}
+
 describe("isValidConsentVisitorId", () => {
   it.each([VALID_ID, "aaaaaaaa-bbbb-4ccc-9ddd-eeeeeeeeeeee"])("%s is a valid v4 UUID", (id) => {
     expect(isValidConsentVisitorId(id)).toBe(true);
@@ -30,26 +98,121 @@ describe("isValidConsentVisitorId", () => {
 });
 
 describe("readConsentVisitor", () => {
-  it("returns the cookie's value when it is a valid id", () => {
-    const cookies = { get: () => ({ value: VALID_ID }) };
-    expect(readConsentVisitor(cookies)).toBe(VALID_ID);
+  it("returns the UUID of a value ensureConsentVisitor signed", () => {
+    const { id, value } = mintedCookie();
+    expect(readConsentVisitor({ get: () => ({ value }) })).toBe(id);
   });
 
   it("returns undefined with no cookie, or an invalid value", () => {
     expect(readConsentVisitor({ get: () => undefined })).toBeUndefined();
     expect(readConsentVisitor({ get: () => ({ value: "nope" }) })).toBeUndefined();
   });
+
+  // #8556: a well-formed id the browser chose is not a visitor id the site minted.
+  it("returns undefined for a bare valid v4 UUID", () => {
+    expect(readConsentVisitor({ get: () => ({ value: VALID_ID }) })).toBeUndefined();
+  });
+
+  it("returns undefined, without throwing, for a changed or truncated signature", () => {
+    const { value } = mintedCookie();
+    expect(readConsentVisitor({ get: () => ({ value: tampered(value) }) })).toBeUndefined();
+    expect(() => readConsentVisitor({ get: () => ({ value: value.slice(0, -3) }) })).not.toThrow();
+    expect(readConsentVisitor({ get: () => ({ value: value.slice(0, -3) }) })).toBeUndefined();
+    expect(readConsentVisitor({ get: () => ({ value: `${VALID_ID}.` }) })).toBeUndefined();
+  });
+
+  it("returns undefined for another id under a valid signature", () => {
+    const { id, value } = mintedCookie();
+    const swapped = value.replace(id, VALID_ID);
+    expect(readConsentVisitor({ get: () => ({ value: swapped }) })).toBeUndefined();
+  });
+
+  it("returns undefined, without throwing, when the secret cannot be resolved", () => {
+    const { value } = mintedCookie();
+    withoutSecret(() => expect(readConsentVisitor({ get: () => ({ value }) })).toBeUndefined());
+  });
+});
+
+// #8556, operator decision option (b): the site signs with a secret it
+// already holds — BETTER_AUTH_SECRET, else AILK_HUB_SESSION_SECRET, else
+// AILK_SPOKE_KEY — and only with none of them does a production mint fail.
+describe("the signing secret, in its fixed order (production)", () => {
+  const PROD = { NODE_ENV: "production" } as const;
+  const AUTH = "auth-secret-of-this-hub-0123456789abcdef";
+  const SESSION = "hub-session-secret-of-this-spoke-0123456789";
+  const SPOKE = "spoke-key-of-this-spoke-0123456789";
+
+  it("a hub signs with BETTER_AUTH_SECRET, ahead of the other two", () => {
+    const all = { ...PROD, BETTER_AUTH_SECRET: AUTH, AILK_HUB_SESSION_SECRET: SESSION, AILK_SPOKE_KEY: SPOKE };
+    const kept = mintThenRead(all, { ...PROD, BETTER_AUTH_SECRET: AUTH });
+    expect(kept.read).toBe(kept.id);
+    expect(mintThenRead(all, { ...PROD, AILK_HUB_SESSION_SECRET: SESSION }).read).toBeUndefined();
+    expect(mintThenRead(all, { ...PROD, AILK_SPOKE_KEY: SPOKE }).read).toBeUndefined();
+  });
+
+  it("a hub-sign-in spoke signs with AILK_HUB_SESSION_SECRET, ahead of AILK_SPOKE_KEY", () => {
+    const spoke = { ...PROD, AILK_HUB_SESSION_SECRET: SESSION, AILK_SPOKE_KEY: SPOKE };
+    const kept = mintThenRead(spoke, { ...PROD, AILK_HUB_SESSION_SECRET: SESSION });
+    expect(kept.read).toBe(kept.id);
+    expect(mintThenRead(spoke, { ...PROD, AILK_SPOKE_KEY: SPOKE }).read).toBeUndefined();
+  });
+
+  it("a spoke holding only AILK_SPOKE_KEY signs and verifies its own id", () => {
+    const spoke = { ...PROD, AILK_SPOKE_KEY: SPOKE };
+    const set = jest.fn();
+    const id = withEnv(spoke, () => ensureConsentVisitor({ get: () => undefined, set }));
+    const value = set.mock.calls[0][1] as string;
+    expect(value).toMatch(new RegExp(`^${id}\\.[A-Za-z0-9_-]{43}$`));
+    expect(withEnv(spoke, () => readConsentVisitor({ get: () => ({ value }) }))).toBe(id);
+    expect(withEnv(spoke, () => readConsentVisitorFromCookieHeader(`ailk-vid=${value}`))).toBe(id);
+  });
+
+  it("a verifier accepts only what its own site signed", () => {
+    const other = (key: string) => `${key}-of-another-site`;
+    expect(mintThenRead({ ...PROD, AILK_SPOKE_KEY: SPOKE }, { ...PROD, AILK_SPOKE_KEY: other(SPOKE) }).read).toBeUndefined();
+    expect(
+      mintThenRead(
+        { ...PROD, AILK_HUB_SESSION_SECRET: SESSION },
+        { ...PROD, AILK_HUB_SESSION_SECRET: other(SESSION) },
+      ).read,
+    ).toBeUndefined();
+    expect(
+      mintThenRead({ ...PROD, BETTER_AUTH_SECRET: AUTH }, { ...PROD, BETTER_AUTH_SECRET: other(AUTH) }).read,
+    ).toBeUndefined();
+  });
+
+  it("a whitespace-only or short spoke secret is none: with nothing else set the mint throws", () => {
+    const set = jest.fn();
+    for (const vars of [
+      { AILK_HUB_SESSION_SECRET: "  ", AILK_SPOKE_KEY: " " },
+      { AILK_HUB_SESSION_SECRET: "x".repeat(31), AILK_SPOKE_KEY: ` ${"y".repeat(31)} ` },
+    ]) {
+      withEnv({ ...PROD, ...vars }, () =>
+        expect(() => ensureConsentVisitor({ get: () => undefined, set })).toThrow(/BETTER_AUTH_SECRET/),
+      );
+    }
+    expect(set).not.toHaveBeenCalled();
+  });
+
+  it("a short AILK_HUB_SESSION_SECRET is skipped for AILK_SPOKE_KEY", () => {
+    const kept = mintThenRead(
+      { ...PROD, AILK_HUB_SESSION_SECRET: "too-short", AILK_SPOKE_KEY: SPOKE },
+      { ...PROD, AILK_SPOKE_KEY: SPOKE },
+    );
+    expect(kept.read).toBe(kept.id);
+  });
 });
 
 describe("ensureConsentVisitor", () => {
-  it("keeps an existing valid id and sets nothing", () => {
+  it("keeps an existing signed id and sets nothing", () => {
+    const { id, value } = mintedCookie();
     const set = jest.fn();
-    const cookies = { get: () => ({ value: VALID_ID }), set };
-    expect(ensureConsentVisitor(cookies)).toBe(VALID_ID);
+    const cookies = { get: () => ({ value }), set };
+    expect(ensureConsentVisitor(cookies)).toBe(id);
     expect(set).not.toHaveBeenCalled();
   });
 
-  it("mints and sets a fresh v4 UUID when absent", () => {
+  it("mints and sets a fresh signed v4 UUID when absent", () => {
     const set = jest.fn();
     const cookies = { get: () => undefined, set };
     const id = ensureConsentVisitor(cookies);
@@ -57,10 +220,25 @@ describe("ensureConsentVisitor", () => {
     expect(set).toHaveBeenCalledTimes(1);
     const [name, value, options] = set.mock.calls[0] as [string, string, Record<string, unknown>];
     expect(name).toBe("ailk-vid");
-    expect(value).toBe(id);
+    expect(value).toMatch(new RegExp(`^${id}\\.[A-Za-z0-9_-]{43}$`));
     expect(options).toMatchObject({ httpOnly: true, sameSite: "lax", path: "/" });
   });
 
+  it("re-mints over a bare UUID, an unsigned cookie from before #8556", () => {
+    const set = jest.fn();
+    const id = ensureConsentVisitor({ get: () => ({ value: VALID_ID }), set });
+    expect(id).not.toBe(VALID_ID);
+    expect(set).toHaveBeenCalledTimes(1);
+  });
+
+  it("throws and sets nothing when the secret cannot be resolved", () => {
+    const set = jest.fn();
+    withoutSecret(() =>
+      expect(() => ensureConsentVisitor({ get: () => undefined, set })).toThrow(/BETTER_AUTH_SECRET/),
+    );
+    expect(set).not.toHaveBeenCalled();
+  });
+
   it("mints a fresh id when the stored value fails the UUID shape", () => {
     const set = jest.fn();
     const cookies = { get: () => ({ value: "garbage" }), set };
@@ -78,8 +256,9 @@ describe("consentVisitorHeader", () => {
 
 describe("readConsentVisitorFromCookieHeader", () => {
   it("reads the id out of a raw Cookie header", () => {
-    expect(readConsentVisitorFromCookieHeader(`ailk-vid=${VALID_ID}`)).toBe(VALID_ID);
-    expect(readConsentVisitorFromCookieHeader(`session=abc; ailk-vid=${VALID_ID}; other=1`)).toBe(VALID_ID);
+    const { id, value } = mintedCookie();
+    expect(readConsentVisitorFromCookieHeader(`ailk-vid=${value}`)).toBe(id);
+    expect(readConsentVisitorFromCookieHeader(`session=abc; ailk-vid=${value}; other=1`)).toBe(id);
   });
 
   it("returns undefined with no header, no matching cookie, or an invalid value", () => {
@@ -88,6 +267,12 @@ describe("readConsentVisitorFromCookieHeader", () => {
     expect(readConsentVisitorFromCookieHeader("session=abc")).toBeUndefined();
     expect(readConsentVisitorFromCookieHeader("ailk-vid=garbage")).toBeUndefined();
   });
+
+  it("returns undefined for a bare UUID or a changed signature (#8556)", () => {
+    const { value } = mintedCookie();
+    expect(readConsentVisitorFromCookieHeader(`ailk-vid=${VALID_ID}`)).toBeUndefined();
+    expect(readConsentVisitorFromCookieHeader(`ailk-vid=${tampered(value)}`)).toBeUndefined();
+  });
 });
 
 // ── acceptCookiesAction / declineCookiesAction (D12) ──────────────────────
@@ -134,15 +319,29 @@ describe("acceptCookiesAction / declineCookiesAction", () => {
   });
 
   it("keeps an existing visitor id and declines", async () => {
-    mockCookieGet.mockReturnValue({ value: VALID_ID });
+    const { id, value } = mintedCookie();
+    mockCookieGet.mockReturnValue({ value });
     const { declineCookiesAction } = await import("../../app/[locale]/consent.actions");
     await declineCookiesAction();
     expect(mockCookieSet).not.toHaveBeenCalled();
     const [body] = mockRecordCookieChoice.mock.calls[0] as [{ visitorId: string; choice: string }];
-    expect(body.visitorId).toBe(VALID_ID);
+    expect(body.visitorId).toBe(id);
     expect(body.choice).toBe("declined");
   });
 
+  it("records nothing and resolves when the secret cannot be resolved (fail closed)", async () => {
+    const error = jest.spyOn(console, "error").mockImplementation(() => {});
+    const { acceptCookiesAction } = await import("../../app/[locale]/consent.actions");
+    try {
+      await withoutSecret(() => expect(acceptCookiesAction()).resolves.toBeUndefined());
+      expect(error).toHaveBeenCalled();
+    } finally {
+      error.mockRestore();
+    }
+    expect(mockCookieSet).not.toHaveBeenCalled();
+    expect(mockRecordCookieChoice).not.toHaveBeenCalled();
+  });
+
   it("resolves even when the client rejects", async () => {
     mockRecordCookieChoice.mockRejectedValue(new TypeError("fetch failed"));
     const { acceptCookiesAction } = await import("../../app/[locale]/consent.actions");

package/templates/apps/web/lib/__tests__/deck-page.test.ts

@@ -50,6 +50,12 @@ describe("deckCandidates (#8687 D3, AC-2)", () => {
     ]);
   });
 
+  it("/pricing/<offering> resolves the offering's Pricing page (#10044 D14)", () => {
+    expect(deckCandidates("/pricing/website-rebuild", LOCALES)).toEqual([
+      { type: "Pricing", slug: "website-rebuild" },
+    ]);
+  });
+
   it("/about (core, always scaffolded) resolves the route row only", () => {
     expect(deckCandidates("/about", LOCALES)).toEqual([
       { type: "AboutPage", slug: "about" },
@@ -108,7 +114,13 @@ describe("DECK_ROUTES parity (#8687 D3)", () => {
       } catch {
         continue;
       }
-      if (!pageSource.includes('bodyMode: "mdx-body"')) {
+      // A content hub (#10121) names its body rule in its HubConfig; the
+      // "mdx-body" and "composed" rules can render the MDX body, as the
+      // inline `bodyMode` literal they replaced did. "sections" never does.
+      const rendersMdxBody =
+        pageSource.includes('bodyMode: "mdx-body"') ||
+        /\bbody: "(?:mdx-body|composed)"/.test(pageSource);
+      if (!rendersMdxBody) {
         sectionsRoutes.add(row.route);
       }
     }

package/templates/apps/web/lib/__tests__/docs-index.test.ts

@@ -0,0 +1,93 @@
+/**
+ * @jest-environment node
+ *
+ * #10041 D8 / AC-2d — `listDocsPages` walks a docs directory and returns one
+ * entry per titled page at the docs' public path, by Fumadocs' slug rule.
+ */
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+type DocsIndexModule = typeof import("../docs-index");
+
+function loadWith(docsPath: string | undefined): DocsIndexModule {
+  if (docsPath === undefined) delete process.env.NEXT_PUBLIC_AILK_DOCS_PATH;
+  else process.env.NEXT_PUBLIC_AILK_DOCS_PATH = docsPath;
+  let mod: DocsIndexModule | undefined;
+  try {
+    jest.isolateModules(() => {
+      mod = jest.requireActual<DocsIndexModule>("../docs-index");
+    });
+  } finally {
+    delete process.env.NEXT_PUBLIC_AILK_DOCS_PATH;
+  }
+  return mod!;
+}
+
+function page(title: string | null, description?: string): string {
+  const lines = ["---"];
+  if (title !== null) lines.push(`title: ${title}`);
+  if (description) lines.push(`description: ${description}`);
+  lines.push("---", "", "Body.", "");
+  return lines.join("\n");
+}
+
+let dir: string;
+
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), "docs-index-"));
+  mkdirSync(join(dir, "guides", "(setup)"), { recursive: true });
+  writeFileSync(join(dir, "index.mdx"), page("Docs", "Everything."));
+  writeFileSync(join(dir, "configure.mdx"), page("Configure", "Set it up."));
+  writeFileSync(join(dir, "guides", "(setup)", "dns.mdx"), page("DNS"));
+  writeFileSync(join(dir, "draft.mdx"), page(null, "No title yet."));
+  writeFileSync(join(dir, "notes.txt"), "not a doc");
+});
+
+afterAll(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe("listDocsPages", () => {
+  it("lists every titled page at the configured path, by the slug rule", () => {
+    const { listDocsPages } = loadWith("/working-theory/docs");
+    expect(listDocsPages(dir)).toEqual([
+      {
+        url: "/working-theory/docs/configure",
+        title: "Configure",
+        description: "Set it up.",
+      },
+      { url: "/working-theory/docs/guides/dns", title: "DNS" },
+      {
+        url: "/working-theory/docs",
+        title: "Docs",
+        description: "Everything.",
+      },
+    ]);
+  });
+
+  it("lists at /docs with no setting", () => {
+    const { listDocsPages } = loadWith(undefined);
+    expect(listDocsPages(dir).map((p) => p.url)).toEqual([
+      "/docs/configure",
+      "/docs/guides/dns",
+      "/docs",
+    ]);
+  });
+
+  it("returns [] for an absent directory", () => {
+    const { listDocsPages } = loadWith("/working-theory/docs");
+    expect(listDocsPages(join(dir, "missing"))).toEqual([]);
+  });
+
+  it("maps an adapter docs row onto the docs path", () => {
+    const { adapterDocsUrl, isDocsType } = loadWith("/working-theory/docs");
+    expect(isDocsType("DocsDetail")).toBe(true);
+    expect(isDocsType("DocsList")).toBe(true);
+    expect(isDocsType("BlogPosting")).toBe(false);
+    expect(adapterDocsUrl("DocsDetail", "configure")).toBe(
+      "/working-theory/docs/configure",
+    );
+    expect(adapterDocsUrl("DocsList", "index")).toBe("/working-theory/docs");
+  });
+});

package/templates/apps/web/lib/__tests__/docs-path.test.ts

@@ -0,0 +1,168 @@
+/**
+ * @jest-environment node
+ *
+ * #10041 D2 — the one docs-path reader. `DOCS_PATH` is read from
+ * `NEXT_PUBLIC_AILK_DOCS_PATH` at module load, so every setting loads the
+ * module afresh under `jest.isolateModules`.
+ */
+import type { NavItem } from "@working-theory/ui";
+import { Menu as Icon } from "lucide-react";
+
+type DocsPathModule = typeof import("../docs-path");
+
+function loadWith(docsPath: string | undefined): DocsPathModule {
+  const previous = process.env.NEXT_PUBLIC_AILK_DOCS_PATH;
+  if (docsPath === undefined) delete process.env.NEXT_PUBLIC_AILK_DOCS_PATH;
+  else process.env.NEXT_PUBLIC_AILK_DOCS_PATH = docsPath;
+  let mod: DocsPathModule | undefined;
+  jest.isolateModules(() => {
+    mod = jest.requireActual<DocsPathModule>("../docs-path");
+  });
+  if (previous === undefined) delete process.env.NEXT_PUBLIC_AILK_DOCS_PATH;
+  else process.env.NEXT_PUBLIC_AILK_DOCS_PATH = previous;
+  return mod!;
+}
+
+describe("docs-path — no setting (AC-3)", () => {
+  const m = loadWith(undefined);
+
+  it("serves the docs at the internal route", () => {
+    expect(m.DOCS_ROUTE).toBe("/docs");
+    expect(m.DOCS_PATH).toBe("/docs");
+  });
+
+  it.each([
+    "/docs",
+    "/docs/configure",
+    "/docs?q=1",
+    "/docs#a",
+    "/about",
+    "https://example.com/docs",
+  ])("toPublicDocsHref is the identity for %s", (href) => {
+    expect(m.toPublicDocsHref(href)).toBe(href);
+  });
+
+  it("maps nothing to the internal route", () => {
+    expect(m.toInternalDocsPath("/docs")).toBeNull();
+    expect(m.toInternalDocsPath("/working-theory/docs")).toBeNull();
+  });
+});
+
+describe("docs-path — docsPath /working-theory/docs (AC-2a, AC-2b)", () => {
+  const m = loadWith("/working-theory/docs");
+
+  it("reads the public base from the env", () => {
+    expect(m.DOCS_ROUTE).toBe("/docs");
+    expect(m.DOCS_PATH).toBe("/working-theory/docs");
+  });
+
+  it.each([
+    ["/docs", "/working-theory/docs"],
+    ["/docs/configure", "/working-theory/docs/configure"],
+    ["/docs/deploy#dns", "/working-theory/docs/deploy#dns"],
+    ["/docs?q=x", "/working-theory/docs?q=x"],
+    ["/docs#top", "/working-theory/docs#top"],
+  ])("rewrites %s to %s", (href, expected) => {
+    expect(m.toPublicDocsHref(href)).toBe(expected);
+  });
+
+  it.each([
+    "https://example.com/docs",
+    "/docsets",
+    "/docs-old",
+    "/pt-BR/docs",
+    "",
+    "#docs",
+    "mailto:a@b.co",
+  ])("leaves %s unchanged", (href) => {
+    expect(m.toPublicDocsHref(href)).toBe(href);
+  });
+
+  it.each([
+    ["/working-theory/docs", "/docs"],
+    ["/working-theory/docs/configure", "/docs/configure"],
+    ["/working-theory/docs/guides/dns", "/docs/guides/dns"],
+  ])("maps the public %s to the internal %s", (bare, internal) => {
+    expect(m.toInternalDocsPath(bare)).toBe(internal);
+  });
+
+  it.each([
+    "/docs",
+    "/docs/configure",
+    "/working-theory",
+    "/working-theory/docsets",
+    "/working-theory/docs-x",
+    "/",
+  ])("does not map %s", (bare) => {
+    expect(m.toInternalDocsPath(bare)).toBeNull();
+  });
+
+  it("maps every nav path at /docs and keeps everything else by reference (AC-2c)", () => {
+    const items: NavItem[] = [
+      {
+        labelKey: "product",
+        flyout: {
+          features: [
+            { labelKey: "f1", path: "/docs/configure", icon: Icon },
+            { labelKey: "f2", path: "/features/one" },
+          ],
+          groups: [
+            { headingKey: "h", items: [{ labelKey: "g1", path: "/docs" }] },
+          ],
+          actions: [{ labelKey: "a1", path: "/docs/start", icon: Icon }],
+          width: "panel",
+        },
+      },
+      { labelKey: "docs", path: "/docs" },
+      { labelKey: "pricing", path: "/pricing", emphasis: "brand" },
+    ];
+    const mapped = m.withPublicDocsPaths(items);
+
+    expect(mapped[0]!.flyout!.features.map((f) => f.path)).toEqual([
+      "/working-theory/docs/configure",
+      "/features/one",
+    ]);
+    expect(mapped[0]!.flyout!.groups![0]!.items[0]!.path).toBe(
+      "/working-theory/docs",
+    );
+    expect(mapped[0]!.flyout!.actions[0]!.path).toBe(
+      "/working-theory/docs/start",
+    );
+    expect(mapped[0]!.flyout!.actions[0]!.icon).toBe(Icon);
+    expect(mapped[0]!.flyout!.features[0]!.icon).toBe(Icon);
+    expect(mapped[0]!.flyout!.width).toBe("panel");
+    expect(mapped[1]).toEqual({
+      labelKey: "docs",
+      path: "/working-theory/docs",
+    });
+    expect(mapped[2]).toEqual({
+      labelKey: "pricing",
+      path: "/pricing",
+      emphasis: "brand",
+    });
+    // The source array is not mutated.
+    expect(items[1]!.path).toBe("/docs");
+  });
+
+  it("maps footer column items", () => {
+    const cols = [
+      {
+        headingKey: "h",
+        items: [
+          { labelKey: "docs", path: "/docs/configure" },
+          { labelKey: "a", path: "/about" },
+        ],
+      },
+    ];
+    expect(m.withPublicDocsColumns(cols)).toEqual([
+      {
+        headingKey: "h",
+        items: [
+          { labelKey: "docs", path: "/working-theory/docs/configure" },
+          { labelKey: "a", path: "/about" },
+        ],
+      },
+    ]);
+    expect(cols[0]!.items[0]!.path).toBe("/docs/configure");
+  });
+});