create-ailk 0.27.0 → 0.28.0

package/templates/apps/web/messages/en.json

@@ -295,7 +295,13 @@
     "addonsHeadline": "Add-ons",
     "monthly": "{amount}/mo",
     "annual": "{amount}/yr",
-    "oneTime": "{amount} one-time"
+    "oneTime": "{amount} one-time",
+    "withRequired": "{plan} + {required}",
+    "depositNote": "{deposit} deposit due today; the balance is invoiced."
+  },
+  "pricingPages": {
+    "heading": "Pricing by offering",
+    "viewPricing": "See pricing"
   },
   "purchasePolicy": {
     "heading": "Purchase Policy",
@@ -393,7 +399,9 @@
   },
   "services": {
     "heading": "Services",
-    "emptyState": "Services listing coming soon."
+    "emptyState": "Services listing coming soon.",
+    "childrenHeading": "Services in this area",
+    "viewService": "View service"
   },
   "software": {
     "heading": "Software",
@@ -425,6 +433,17 @@
     "heading": "Alternatives",
     "emptyState": "Comparisons coming soon."
   },
+  "templates": {
+    "heading": "Templates",
+    "emptyState": "Templates coming soon.",
+    "getIt": "Get it",
+    "startFree": "Start free",
+    "viewDemo": "View demo",
+    "viewTemplate": "View template",
+    "included": "What's included",
+    "demoBadge": "Live demo",
+    "moreCategories": "+{count} more"
+  },
   "reports": {
     "heading": "Reports",
     "emptyState": "Reports coming soon.",
@@ -1256,26 +1275,46 @@
       "heading": "Integrations",
       "lead": "Connect the services your site works with.",
       "slack": {
-        "title": "Slack",
-        "credentialsHeading": "App credentials",
+        "title": "Connection",
         "connectedBadge": "Connected",
-        "notConnectedBadge": "Not connected",
-        "lead": "Connect your Slack app so each booked prospect gets a shared channel.",
-        "botTokenLabel": "Bot token",
-        "signingSecretLabel": "Signing secret",
+        "row": {
+          "notConnectedTitle": "Enable team collaboration in Slack",
+          "notConnectedLine": "Connect your Slack workspace so your team can work with this site in Slack.",
+          "connectedTitle": "Site workspace",
+          "connectedLine": "Enable team collaboration in Slack.",
+          "unavailableTitle": "We couldn't check Slack.",
+          "unavailableLine": "The Slack connection didn't load. Try again in a moment."
+        },
+        "connect": "Connect",
+        "tryAgain": "Try again",
+        "moreActions": "More Slack actions",
+        "replace": "Replace…",
+        "disconnect": "Disconnect…",
+        "setup": {
+          "region": "Set up Slack",
+          "tokenStep": "Create a Slack app and paste its bot token",
+          "tokenTip": "The app needs a paid Slack plan and these bot scopes:",
+          "tipLabel": "More about this step",
+          "openSlackApps": "Open Slack apps",
+          "slackAppsHref": "https://api.slack.com/apps",
+          "tokenPlaceholder": "xoxb-…",
+          "tokenSaved": "Bot token saved",
+          "urlStep": "Copy the events URL into Slack",
+          "urlTip": "In your Slack app, open Event Subscriptions, turn on events, paste this as the Request URL, and subscribe to the bot events {events}.",
+          "urlUnavailable": "The API's address isn't configured, so the events URL can't be shown.",
+          "copy": "Copy",
+          "copied": "Copied",
+          "urlCopied": "Events URL copied",
+          "secretStep": "Paste the app’s signing secret",
+          "secretTip": "In your Slack app, under Basic Information → App Credentials.",
+          "secretPlaceholder": "Signing secret",
+          "save": "Save",
+          "saving": "Saving…",
+          "cancel": "Cancel",
+          "done": "Done"
+        },
         "botTokenInvalid": "A bot token starts with xoxb- and holds only letters, digits and hyphens.",
         "signingSecretInvalid": "A signing secret is 32 to 128 letters and digits.",
-        "scopesLead": "The Slack app needs these bot scopes:",
-        "connect": "Connect Slack",
-        "connecting": "Connecting…",
-        "cancel": "Cancel",
-        "replace": "Replace",
-        "disconnect": "Disconnect",
-        "workspaceName": "Slack workspace",
-        "connectedOn": "Connected",
-        "ownerOnly": "Only the site's owner can change the Slack connection.",
-        "askOwner": "Slack isn't connected. Ask the site's owner to connect it.",
-        "unavailable": "The Slack connection couldn't be read. Try again later.",
         "tokenRefused": {
           "tokenRefused": "Slack refused this token. Check it and try again.",
           "notBotToken": "This isn't a bot token. Copy the Bot User OAuth Token (xoxb-).",
@@ -1301,15 +1340,16 @@
       "prospectChannel": {
         "heading": "Prospect channels",
         "lead": "Open a shared Slack channel with each prospect who books a meeting.",
-        "enabled": "Open a channel for each booking",
-        "members": "Members",
-        "ownerAlwaysInvited": "The site's owner is always invited. Add anyone else by Slack member id.",
-        "addMemberLabel": "Slack member id",
-        "addMember": "Add",
-        "removeMember": "Remove {memberId}",
-        "welcomeTemplate": "Welcome message",
-        "welcomeDefaultNote": "Leave blank to send the default welcome.",
-        "mergeFieldsHeading": "Merge fields",
+        "switchLabel": "Prospect channels",
+        "showSettings": "Show prospect channel settings",
+        "hideSettings": "Hide prospect channel settings",
+        "members": "Your channel team members",
+        "membersTipLabel": "About members",
+        "membersTip": "Slack member ids of teammates to add to each new channel, separated by commas. The site's owner is always added.",
+        "membersPlaceholder": "U012AB3CD, U045EF6GH",
+        "welcomeTemplate": "Welcome message for prospects",
+        "mergeFieldsLabel": "Merge fields",
+        "mergeFieldsLead": "You can use",
         "mergeFields": {
           "firstName": "The prospect's first name",
           "hostName": "The host's name",
@@ -1318,7 +1358,11 @@
           "timeline": "The prospect's timeline",
           "meetingLink": "The meeting link"
         },
-        "channelPrefix": "Channel name prefix",
+        "welcomePlaceholder": "Leave blank to send the default welcome.",
+        "channelPrefix": "Channel prefix",
+        "prefixTipLabel": "About the channel prefix",
+        "prefixTip": "Each booking gets its own new Slack channel. Its name starts with this prefix, then a short random code, like {example}, so all prospect channels sort together in Slack.",
+        "prefixExample": "prospect-k3x9m2qa",
         "archiveDays": "Archive after (days)",
         "save": "Save",
         "saving": "Saving…",
@@ -1327,7 +1371,7 @@
         "slackNotConnected": "Slack isn't connected, so these settings can't be changed.",
         "connectSlackLink": "Connect Slack",
         "errors": {
-          "memberIds": "Enter a new Slack member id, like U012AB3CD (up to 50).",
+          "memberIds": "Enter Slack member ids like U012AB3CD, separated by commas, with no repeats (up to 50).",
           "welcomeTemplate": "Use only the merge fields listed, in up to 4,000 characters.",
           "channelPrefix": "Use lowercase letters, digits, - and _, starting with a letter or digit (up to 21).",
           "archiveDays": "Enter a whole number of days from 1 to 365."
@@ -1455,5 +1499,17 @@
     "already": "You were already unsubscribed.",
     "invalid": "This link isn't valid.",
     "unavailable": "Unsubscribing isn't available right now."
+  },
+  "hubConnect": {
+    "metaTitle": "Sign in to a site",
+    "title": "Sign in to {name}?",
+    "lead": "{origin} will see your name and email address, {email}. We ask once for each site.",
+    "continue": "Continue",
+    "cancel": "Cancel",
+    "unavailable": {
+      "title": "This sign-in can't continue",
+      "body": "The link may have expired. Go back to the site you came from and sign in again.",
+      "back": "Back to your account"
+    }
   }
 }

package/templates/apps/web/middleware.ts

@@ -19,6 +19,29 @@
 // here rather than in the matcher, because this middleware is the only place
 // the security headers are stamped.
 //
+// The spoke file routes (#9162) — `/reports/<slug>/file`,
+// `/account/inbox/message/<id>/file` and
+// `/account/artifacts/<pieceId>/versions/<version>/file` — get every baseline
+// header but the CSP. Their handlers set the hub's sandbox policy, and this
+// middleware runs before them: Next puts its headers on the response first and
+// adds a handler header only where none is set yet, so a site CSP stamped here
+// would replace the sandbox one on the wire.
+//
+// Docs path (#10041 D3). A site that sets `docsPath` in `_site.mdx` serves
+// its docs there: a request at or under the public path (bare or after an
+// enabled-locale prefix) is handed to next-intl as the internal `/docs` route,
+// so its rewrite lands on `app/[locale]/docs/` while the browser keeps the
+// public URL; a redirect's `Location` and every `Link` hreflang entry are
+// mapped back onto the public path. The internal `/docs` itself answers with
+// the site's 404, before next-intl, so no locale redirect intervenes. A site
+// with no `docsPath` takes none of these branches.
+//
+// Services path (#10043 D5). The same mapping for a site that sets
+// `services.path` in `_site.mdx`, except that the internal `/services` (and
+// everything under it) answers a 308 onto the same rest under the public
+// base, so old links keep working. A site with no `services.path` takes none
+// of these branches.
+//
 // S16 spec: docs/internal/specs/ailk-pre-oss-security-phase-3-s16-security-headers-spec.md
 // S2 spec:  docs/internal/specs/i18n-phase1-s2-next-intl-foundation-spec.md
 // P2 S1 spec: docs/internal/specs/i18n-phase2-s1-hreflang-metadata-spec.md §3
@@ -27,7 +50,19 @@ import { NextRequest, NextResponse } from "next/server";
 import createMiddleware from "next-intl/middleware";
 
 import { isBookingPath } from "./lib/auth-routes";
-import { SCHEDULING_PAGES } from "./lib/modules.generated";
+import {
+  DOCS_PATH,
+  DOCS_ROUTE,
+  toInternalDocsPath,
+  toPublicDocsHref,
+} from "./lib/docs-path";
+import { PUBLIC_PAGES, SCHEDULING_PAGES } from "./lib/modules.generated";
+import {
+  SERVICES_PATH,
+  SERVICES_ROUTE,
+  toInternalServicesPath,
+  toPublicServicesHref,
+} from "./lib/services-path";
 import {
   DEFAULT_SECURITY_HEADERS,
   SCHEDULING_SECURITY_HEADERS,
@@ -70,6 +105,76 @@ export function isNonLocaleRoute(pathname: string): boolean {
   );
 }
 
+// The file routes' paths after an enabled-locale prefix; a route group adds no
+// segment, so `(authed)` is not in them. Kept in step with every route handler
+// that sets its own CSP by the drift test in
+// __tests__/middleware-file-routes.test.ts.
+const FILE_ROUTE_PATHS = [
+  /^\/reports\/[^/]+\/file$/,
+  /^\/account\/inbox\/message\/[^/]+\/file$/,
+  /^\/account\/artifacts\/[^/]+\/versions\/[^/]+\/file$/,
+];
+
+const LOCALE_PREFIX = new RegExp(`^/(${enabledLocales.join("|")})(?=/)`);
+
+export function isFileRoutePath(pathname: string): boolean {
+  const bare = pathname.replace(LOCALE_PREFIX, "");
+  return FILE_ROUTE_PATHS.some((path) => path.test(bare));
+}
+
+// The path the hidden docs route is rewritten to. Its first segment is no
+// enabled locale, so the locale layout's `assertEnabledLocale` answers it with
+// the site's not-found page (#10041 D3).
+const DOCS_UNMOUNTED_PATH = "/_ailk-docs-unmounted";
+
+function splitLocalePrefix(pathname: string): { prefix: string; bare: string } {
+  const prefix = LOCALE_PREFIX.exec(pathname)?.[0] ?? "";
+  return { prefix, bare: pathname.slice(prefix.length) };
+}
+
+/**
+ * `url` (absolute) with its locale-less pathname mapped back onto a public
+ * path by `toPublicHref` — `toPublicDocsHref` or `toPublicServicesHref`.
+ */
+function toPublicUrl(url: string, toPublicHref: (bare: string) => string): string {
+  const parsed = new URL(url);
+  const { prefix, bare } = splitLocalePrefix(parsed.pathname);
+  parsed.pathname = prefix + toPublicHref(bare);
+  return parsed.toString();
+}
+
+/**
+ * next-intl's response for a mapped docs or services request, with the
+ * internal path it was handed mapped back onto the public one: a redirect's
+ * `Location` and each `<url>` of the hreflang `Link` header. A rewrite is
+ * left as is.
+ */
+function withPublicUrls(
+  response: NextResponse,
+  toPublicHref: (bare: string) => string,
+): NextResponse {
+  const location = response.headers.get("location");
+  if (location) response.headers.set("location", toPublicUrl(location, toPublicHref));
+  const link = response.headers.get("Link");
+  if (link) {
+    response.headers.set(
+      "Link",
+      link.replace(/<([^>]+)>/g, (_entry, url: string) => `<${toPublicUrl(url, toPublicHref)}>`),
+    );
+  }
+  return response;
+}
+
+/** The baseline map without its CSP, for the file routes. */
+const FILE_ROUTE_SECURITY_HEADERS: Readonly<Record<string, string>> =
+  Object.freeze(
+    Object.fromEntries(
+      Object.entries(DEFAULT_SECURITY_HEADERS).filter(
+        ([name]) => name !== "Content-Security-Policy",
+      ),
+    ),
+  );
+
 export function middleware(request: NextRequest): NextResponse {
   // Step 1: Forward x-pathname to server components so generateMetadata can
   // build path-aware hreflang alternates (P2 S1). Clone the request headers
@@ -82,27 +187,82 @@ export function middleware(request: NextRequest): NextResponse {
   if (isNonLocaleRoute(request.nextUrl.pathname)) {
     const res = NextResponse.next({ request: { headers: requestHeaders } });
     applyHeaders(res.headers, DEFAULT_SECURITY_HEADERS);
+    if (!PUBLIC_PAGES) res.headers.set("X-Robots-Tag", "noindex");
     return res;
   }
 
-  const requestWithPathname = new NextRequest(request.url, {
-    headers: requestHeaders,
-    method: request.method,
-    body: request.body,
-  });
+  // #10041 D3 — on a site that moved its docs, map the public docs path onto
+  // the internal route, and answer the internal route itself with the 404.
+  let docsInternalUrl: URL | null = null;
+  if (DOCS_PATH !== DOCS_ROUTE) {
+    const { prefix, bare } = splitLocalePrefix(request.nextUrl.pathname);
+    const internal = toInternalDocsPath(bare);
+    if (internal !== null) {
+      docsInternalUrl = request.nextUrl.clone();
+      docsInternalUrl.pathname = prefix + internal;
+    } else if (bare === DOCS_ROUTE || bare.startsWith(`${DOCS_ROUTE}/`)) {
+      const res = NextResponse.rewrite(new URL(DOCS_UNMOUNTED_PATH, request.url), {
+        request: { headers: requestHeaders },
+      });
+      applyHeaders(res.headers, DEFAULT_SECURITY_HEADERS);
+      if (!PUBLIC_PAGES) res.headers.set("X-Robots-Tag", "noindex");
+      return res;
+    }
+  }
+
+  // #10043 D5 — on a site that moved its services, map the public base onto
+  // the internal route, and answer the internal route itself with a 308 onto
+  // the base (same origin, same locale prefix and query, so it cannot leave
+  // the site).
+  let servicesInternalUrl: URL | null = null;
+  if (docsInternalUrl === null && SERVICES_PATH !== SERVICES_ROUTE) {
+    const { prefix, bare } = splitLocalePrefix(request.nextUrl.pathname);
+    const internal = toInternalServicesPath(bare);
+    if (internal !== null) {
+      servicesInternalUrl = request.nextUrl.clone();
+      servicesInternalUrl.pathname = prefix + internal;
+    } else if (bare === SERVICES_ROUTE || bare.startsWith(`${SERVICES_ROUTE}/`)) {
+      const target = request.nextUrl.clone();
+      target.pathname = prefix + toPublicServicesHref(bare);
+      const res = NextResponse.redirect(target, 308);
+      applyHeaders(res.headers, DEFAULT_SECURITY_HEADERS);
+      if (!PUBLIC_PAGES) res.headers.set("X-Robots-Tag", "noindex");
+      return res;
+    }
+  }
+
+  const requestWithPathname = new NextRequest(
+    docsInternalUrl ?? servicesInternalUrl ?? request.url,
+    {
+      headers: requestHeaders,
+      method: request.method,
+      body: request.body,
+    },
+  );
 
   // Step 2: run next-intl middleware (locale detection + rewrite/redirect)
-  const intlResponse = intlMiddleware(requestWithPathname) as NextResponse;
+  let intlResponse = intlMiddleware(requestWithPathname) as NextResponse;
+  if (docsInternalUrl) intlResponse = withPublicUrls(intlResponse, toPublicDocsHref);
+  if (servicesInternalUrl) {
+    intlResponse = withPublicUrls(intlResponse, toPublicServicesHref);
+  }
 
   // Step 3: apply the 7 baseline security headers to the response. The booking
   // pages of a site that carries the scheduling module get the same map with
-  // Cal.com's origin added to the CSP (#8843 D12); no other page does.
+  // Cal.com's origin added to the CSP (#8843 D12); no other page does. The
+  // file routes get the six others and keep their own sandbox CSP (#9162).
   applyHeaders(
     intlResponse.headers,
-    SCHEDULING_PAGES && isBookingPath(request.nextUrl.pathname, enabledLocales)
-      ? SCHEDULING_SECURITY_HEADERS
-      : DEFAULT_SECURITY_HEADERS,
+    isFileRoutePath(request.nextUrl.pathname)
+      ? FILE_ROUTE_SECURITY_HEADERS
+      : SCHEDULING_PAGES &&
+          isBookingPath(request.nextUrl.pathname, enabledLocales)
+        ? SCHEDULING_SECURITY_HEADERS
+        : DEFAULT_SECURITY_HEADERS,
   );
+  // #10040 decision 7 — a site with neither marketing nor docs-blog (a hub)
+  // asks every crawler to keep out of every page, read from the module list.
+  if (!PUBLIC_PAGES) intlResponse.headers.set("X-Robots-Tag", "noindex");
 
   return intlResponse;
 }

package/templates/apps/web/next.config.mjs

@@ -1,10 +1,11 @@
-import { readFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { parse as parseYaml } from "yaml";
 import bundleAnalyzer from "@next/bundle-analyzer";
 import { withSentryConfig } from "@sentry/nextjs";
 import createNextIntlPlugin from "next-intl/plugin";
-import { legacyRedirects } from "@working-theory/templates/routes";
+import { DocsPathSchema, ServicesPathSchema } from "@working-theory/site-config/schema";
+import { legacyRedirects, ROUTES, SERVICES_ROUTE } from "@working-theory/templates/routes";
 import { parseStealth } from "@working-theory/web-i18n/stealth";
 import { withBotId } from "botid/next/config";
 
@@ -81,6 +82,203 @@ function readDefaultLocaleFromProjectYaml() {
 const enabledLocalesAtBuild = readLocalesFromProjectYaml();
 const defaultLocaleAtBuild = readDefaultLocaleFromProjectYaml();
 
+// #10041 D4 — where the docs live. A site sets `docsPath` in
+// content/_site.mdx (its own file, which `create-ailk update` never rewrites);
+// it is read here, refused by name when it cannot be served, and baked into
+// NEXT_PUBLIC_AILK_DOCS_PATH for the middleware and every docs-URL reader
+// (lib/docs-path.ts). Absent — the file, its frontmatter or the key — is
+// `/docs`, today's path. A refusal throws, so `next build` fails before a page
+// renders (the parseStealth posture).
+const DOCS_ROUTE = "/docs";
+
+function refuseDocsPath(value, reason) {
+  throw new Error(`content/_site.mdx docsPath ${value}: ${reason}`);
+}
+
+/**
+ * The mount checks a public path takes before it is served (#10041 D4, shared
+ * with `services.path` by #10043 D4), each refused through `refuse`:
+ *
+ * 1. A locale code as the first segment would be read as the locale.
+ * 2. A path that shadows another page, or sits under a catch-all. A route is
+ *    shadowed when the path matches its leading segments, a `:param` segment
+ *    matching any one segment (`/products/docs` hides the `/products/:slug`
+ *    page whose slug is `docs`). `ownRoutes` are the setting's own rows.
+ */
+function refuseUnmountablePath(value, ownRoutes, refuse) {
+  const firstSegment = value.split("/")[1];
+  const locales = enabledLocalesAtBuild.split(",").map((l) => l.toLowerCase());
+  if (locales.includes(firstSegment)) {
+    refuse(value, `its first segment is the enabled locale ${firstSegment}`);
+  }
+
+  const valueSegments = value.split("/").slice(1);
+  for (const { route } of ROUTES) {
+    if (ownRoutes.includes(route)) continue;
+    const catchAll = /^(.*)\/:\.\.\.[^/]+$/.exec(route);
+    if (catchAll) {
+      if (value.startsWith(`${catchAll[1]}/`)) {
+        refuse(value, `it is under the ${catchAll[1]} catch-all route`);
+      }
+      continue;
+    }
+    const routeSegments = route.split("/").slice(1);
+    const shadows =
+      valueSegments.length <= routeSegments.length &&
+      valueSegments.every(
+        (segment, i) =>
+          routeSegments[i].startsWith(":") || routeSegments[i] === segment,
+      );
+    if (shadows) refuse(value, `it shadows the ${route} route`);
+  }
+}
+
+const contentRootAtBuild =
+  process.env.AILK_CONTENT_ROOT || join(process.cwd(), "../../content");
+
+/** A file's YAML frontmatter, parsed; `undefined` when absent or unreadable. */
+function readFrontmatter(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return undefined;
+  }
+  // The frontmatter is the text between the first two `---` lines.
+  const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(raw);
+  return match ? parseYaml(match[1]) : undefined;
+}
+
+const siteFrontmatterAtBuild = readFrontmatter(join(contentRootAtBuild, "_site.mdx"));
+
+function readDocsPathFromSiteMdx() {
+  const value = siteFrontmatterAtBuild?.docsPath;
+  if (value === undefined || value === null) return DOCS_ROUTE;
+
+  const parsed = DocsPathSchema.safeParse(value);
+  if (!parsed.success) {
+    refuseDocsPath(
+      value,
+      "must be one to four lowercase kebab segments with a leading slash and no trailing slash, not starting with api, og or v1, and not under /docs",
+    );
+  }
+  const docsPath = parsed.data;
+  refuseUnmountablePath(
+    docsPath,
+    [DOCS_ROUTE, `${DOCS_ROUTE}/:...slug`],
+    refuseDocsPath,
+  );
+
+  // 3. The site's docs-blog files must follow the setting: its docs source
+  //    must take `DOCS_PATH` as its base.
+  if (docsPath !== DOCS_ROUTE) {
+    const sourcePath = join(process.cwd(), "lib/source.ts");
+    if (!existsSync(sourcePath)) {
+      refuseDocsPath(docsPath, "the site carries no docs-blog module");
+    }
+    if (!/\bbaseUrl:\s*DOCS_PATH\b/.test(readFileSync(sourcePath, "utf8"))) {
+      refuseDocsPath(
+        docsPath,
+        "this site's docs-blog files predate docsPath; re-install the docs-blog module's files",
+      );
+    }
+  }
+  return docsPath;
+}
+
+const docsPathAtBuild = readDocsPathFromSiteMdx();
+
+// #10043 D4 — where the services live, and their categories. A site sets
+// `services: { path: /capabilities }` in content/_site.mdx; it is read here,
+// refused by name when it cannot be served, and baked into
+// NEXT_PUBLIC_AILK_SERVICES_PATH for the middleware, the page renderer and
+// every services-URL reader (lib/services-path.ts). Absent is `/services`.
+// A Service's `parent` (its category) is checked here too, for the default
+// locale's MDX files: it must name a Service with no parent of its own, and
+// the site must carry the nested route.
+
+function refuseServicesPath(value, reason) {
+  throw new Error(`content/_site.mdx services.path ${value}: ${reason}`);
+}
+
+function readServicesPathFromSiteMdx() {
+  const value = siteFrontmatterAtBuild?.services?.path;
+  if (value === undefined || value === null) return SERVICES_ROUTE;
+
+  const parsed = ServicesPathSchema.safeParse(value);
+  if (!parsed.success) {
+    refuseServicesPath(
+      value,
+      "must be one to four lowercase kebab segments with a leading slash and no trailing slash, not starting with api, og or v1, and not under /services",
+    );
+  }
+  const servicesPath = parsed.data;
+  refuseUnmountablePath(
+    servicesPath,
+    [SERVICES_ROUTE, `${SERVICES_ROUTE}/:slug`, `${SERVICES_ROUTE}/:slug/:child`],
+    refuseServicesPath,
+  );
+  // Two moved mounts must not overlap, in either direction.
+  const overlaps = (a, b) => a === b || a.startsWith(`${b}/`);
+  if (overlaps(servicesPath, docsPathAtBuild) || overlaps(docsPathAtBuild, servicesPath)) {
+    refuseServicesPath(servicesPath, `it overlaps docsPath ${docsPathAtBuild}`);
+  }
+  return servicesPath;
+}
+
+function refuseServiceParent(file, value, reason) {
+  throw new Error(`${file} parent ${value}: ${reason}`);
+}
+
+function readServiceParents() {
+  // Under the database adapter the pages are not on disk; the nested route
+  // answers 404 for a bad parent at request time instead.
+  if (process.env.CONTENT_ADAPTER === "database") return;
+  const dirs = [`${defaultLocaleAtBuild}/Service`, "Service"];
+  const nestedRoute = join(process.cwd(), "app/[locale]/services/[slug]/[child]/page.tsx");
+  for (const dir of dirs) {
+    let files;
+    try {
+      files = readdirSync(join(contentRootAtBuild, dir)).filter((f) => f.endsWith(".mdx"));
+    } catch {
+      continue;
+    }
+    const pages = files.map((file) => {
+      const frontmatter = readFrontmatter(join(contentRootAtBuild, dir, file)) ?? {};
+      return {
+        file: `content/${dir}/${file}`,
+        slug: frontmatter.slug ?? file.replace(/\.mdx$/, ""),
+        parent: frontmatter.parent,
+      };
+    });
+    const bySlug = new Map(pages.map((page) => [page.slug, page]));
+    for (const page of pages) {
+      if (page.parent === undefined || page.parent === null) continue;
+      const category = bySlug.get(page.parent);
+      if (category === undefined) {
+        refuseServiceParent(page.file, page.parent, `it names no Service in content/${dir}`);
+      }
+      if (category.parent !== undefined && category.parent !== null) {
+        refuseServiceParent(
+          page.file,
+          page.parent,
+          "that Service has its own parent; services take one category level",
+        );
+      }
+      if (!existsSync(nestedRoute)) {
+        refuseServiceParent(
+          page.file,
+          page.parent,
+          "this site's services routes predate service categories; run create-ailk sync-routes",
+        );
+      }
+    }
+  }
+}
+
+const servicesPathAtBuild = readServicesPathFromSiteMdx();
+readServiceParents();
+
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   reactStrictMode: true,
@@ -105,6 +303,10 @@ const nextConfig = {
   // output shipped without them and postbuild's assert-content-bundled failed.
   outputFileTracingIncludes: {
     "/**": ["../../content/**/*.mdx"],
+    // #10041 D8 — /sitemap.xml and /llms.txt list the docs by reading this
+    // app's own content/<locale>/docs/ at request time.
+    "/sitemap.xml": ["./content/**/*.mdx"],
+    "/llms.txt": ["./content/**/*.mdx"],
   },
   // Workspace packages live outside this app's directory. Next.js must
   // transpile them from source so that "use client" / "use server" directives
@@ -161,6 +363,13 @@ const nextConfig = {
     // onto the hub's. Part of the source, not an operator setting: a build
     // that carries the relay always carries the flag, and no other build does.
     NEXT_PUBLIC_AILK_SAME_ORIGIN_RELAY: "1",
+    // The docs' public path (#10041), from content/_site.mdx's docsPath, or
+    // `/docs`. Read by middleware.ts and lib/docs-path.ts.
+    NEXT_PUBLIC_AILK_DOCS_PATH: docsPathAtBuild,
+    // The services' public base (#10043), from content/_site.mdx's
+    // services.path, or `/services`. Read by middleware.ts,
+    // lib/services-path.ts and @working-theory/page-renderer.
+    NEXT_PUBLIC_AILK_SERVICES_PATH: servicesPathAtBuild,
   },
   async headers() {
     if (!STEALTH) return [];

package/templates/apps/web/package.json

@@ -6,7 +6,7 @@
   "license": "Apache-2.0",
   "scripts": {
     "dev": "next dev --webpack",
-    "build": "next build --webpack",
+    "build": "tsx scripts/check-nav-labels.ts && next build --webpack",
     "postbuild": "tsx scripts/assert-content-bundled.ts",
     "start": "next start",
     "type-check": "tsc --noEmit",