create-ailk 0.27.0 → 0.28.1

package/templates/apps/web/app/[locale]/testimonials/__tests__/page-renderer-migration.test.tsx

@@ -79,7 +79,7 @@ describe("TestimonialsPage — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(
-      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Customer Testimonials","description":"What our customers say.","mainEntity":{"@type":"ItemList","itemListElement":[{"@type":"Review"}]},"aggregateRating":{"@context":"https://schema.org","@type":"AggregateRating","ratingValue":4.9,"reviewCount":0,"bestRating":5,"worstRating":1,"itemReviewed":{"@type":"SoftwareApplication"}}}</script><main id="main"><div><h1>Customer Testimonials</h1><p data-testid="testimonials-description" class="mt-block-tight text-lead">What our customers say.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle mt-block-loose"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source=""></div></article></div></div></div></main>"`,
+      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Customer Testimonials","description":"What our customers say.","mainEntity":{"@type":"ItemList","itemListElement":[{"@type":"Review"}]},"aggregateRating":{"@context":"https://schema.org","@type":"AggregateRating","ratingValue":4.9,"reviewCount":0,"bestRating":5,"worstRating":1,"itemReviewed":{"@type":"SoftwareApplication"}}}</script><main id="main"><div><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source=""></div></article></div></div></div></main>"`,
     );
   });
 });

package/templates/apps/web/app/[locale]/whitepapers/[slug]/page.tsx

@@ -1,7 +1,11 @@
 // Whitepaper detail page. Reads the Whitepaper MDX for the given slug, renders via
 // @working-theory/page-renderer, and emits a JSON-LD <script>. Unknown slugs trigger 404.
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
-import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
+import {
+  getMdxSource as loadMdxSource,
+  renderPage,
+  renderPageMetadata,
+} from "@working-theory/page-renderer";
 import type { Metadata } from "next";
 import type { ReactElement } from "react";
 
@@ -22,12 +26,29 @@ export default async function Page({
   getMdxSource,
 }: Props): Promise<ReactElement> {
   const { locale, slug } = await params;
+  // A page that composes `sections[]` renders them (JSON-LD is built from
+  // the same sections); a prose page renders its MDX body — the rule
+  // /vs/[slug] applies (#10122).
+  const source = await (getMdxSource ?? loadMdxSource)(
+    "Whitepaper",
+    slug,
+    locale,
+  );
+  const composed =
+    source !== null &&
+    Array.isArray((source.frontmatter as { sections?: unknown[] }).sections) &&
+    ((source.frontmatter as { sections?: unknown[] }).sections?.length ?? 0) >
+      0;
   return renderPage({
     type: "Whitepaper",
     slug,
     locale,
-    bodyMode: "mdx-body",
-    populatedDescriptionTestId: "whitepaper-description",
+    ...(composed
+      ? {}
+      : {
+          bodyMode: "mdx-body" as const,
+          populatedDescriptionTestId: "whitepaper-description",
+        }),
     ...(getMdxSource !== undefined && { getMdxSource }),
   });
 }

package/templates/apps/web/app/[locale]/whitepapers/__tests__/page-renderer-migration.test.tsx

@@ -62,7 +62,7 @@ describe("whitepapers/[slug] — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(`
-     "<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@graph":[{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"AILK AEO Strategy 2026","description":"In-depth research on answer engine optimization for AILK products.","mainEntity":{"@context":"https://schema.org","@type":"Article","headline":"AILK AEO Strategy 2026","description":"In-depth research on answer engine optimization for AILK products."}},{"@context":"https://schema.org","@type":"BreadcrumbList","inLanguage":"en","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http://localhost:3000/en/"},{"@type":"ListItem","position":2,"name":"Whitepapers","item":"http://localhost:3000/en/whitepapers"},{"@type":"ListItem","position":3,"name":"AILK AEO Strategy 2026","item":"http://localhost:3000/en/whitepapers/ailk-aeo-strategy-2026"}]}]}</script><main id="main"><div class="mx-auto w-full max-w-container-xl px-4 md:px-6 lg:px-8 py-section"><h1 class="text-heading-1 lg:text-display-sm font-display text-fg hero-type-display">AILK AEO Strategy 2026</h1><p data-testid="whitepaper-description" class="mt-block-tight text-lead">In-depth research on answer engine optimization for AILK products.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle mt-block-loose"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div class="ailk-prose max-w-none text-(--color-text-muted) text-body-sm leading-relaxed [&amp;>*:first-child]:mt-0 [&amp;_h2]:mt-block-loose [&amp;_h2]:scroll-mt-24 [&amp;_h2]:text-heading-3 [&amp;_h2]:font-display [&amp;_h2]:text-(--color-fg) [&amp;_h3]:mt-block-loose [&amp;_h3]:scroll-mt-24 [&amp;_h3]:text-heading-4 [&amp;_h3]:font-display [&amp;_h3]:text-(--color-fg) [&amp;_h4]:mt-block-tight [&amp;_h4]:scroll-mt-24 [&amp;_h4]:text-heading-4 [&amp;_h4]:font-display [&amp;_h4]:text-(--color-fg) [&amp;_h5]:mt-block-tight [&amp;_h5]:scroll-mt-24 [&amp;_h5]:text-heading-4 [&amp;_h5]:font-display [&amp;_h5]:text-(--color-fg) [&amp;_h6]:mt-block-tight [&amp;_h6]:scroll-mt-24 [&amp;_h6]:text-heading-4 [&amp;_h6]:font-display [&amp;_h6]:text-(--color-fg) [&amp;_p]:mt-paragraph [&amp;_strong]:font-semibold [&amp;_strong]:text-(--color-fg) [&amp;_em]:italic [&amp;_ul]:mt-paragraph [&amp;_ul]:list-disc [&amp;_ul]:ps-6 [&amp;_ol]:mt-paragraph [&amp;_ol]:list-decimal [&amp;_ol]:ps-6 [&amp;_li]:mt-1 [&amp;_li]:ps-1 [&amp;_li]:marker:text-(--color-text-muted) [&amp;_li>ul]:mt-1 [&amp;_li>ol]:mt-1 [&amp;_blockquote]:mt-paragraph [&amp;_blockquote]:border-s-4 [&amp;_blockquote]:border-(--color-border-strong) [&amp;_blockquote]:ps-4 [&amp;_blockquote]:italic [&amp;_blockquote]:text-(--color-text-muted) [&amp;_hr]:my-block-loose [&amp;_hr]:border-(--color-border) [&amp;_a]:text-(--color-accent) [&amp;_a]:underline [&amp;_a]:underline-offset-4 [&amp;_:not(pre)>code]:rounded [&amp;_:not(pre)>code]:bg-(--color-surface-secondary) [&amp;_:not(pre)>code]:px-1.5 [&amp;_:not(pre)>code]:py-0.5 [&amp;_:not(pre)>code]:text-code [&amp;_:not(pre)>code]:font-mono [&amp;_:not(pre)>code]:text-(--color-fg) [&amp;_pre]:mt-paragraph [&amp;_pre]:overflow-auto [&amp;_pre]:rounded-md [&amp;_pre]:border-hairline [&amp;_pre]:border-(--color-border) [&amp;_pre]:bg-(--color-bg) [&amp;_pre]:p-4 [&amp;_pre]:font-mono [&amp;_pre]:text-body-sm [&amp;_img]:mt-paragraph [&amp;_img]:h-auto [&amp;_img]:max-w-full [&amp;_img]:rounded-lg [&amp;_table]:mt-paragraph [&amp;_table]:w-full [&amp;_table]:border-collapse [&amp;_table]:text-body-sm [&amp;_th]:border-b [&amp;_th]:border-(--color-border) [&amp;_th]:bg-(--color-surface-secondary) [&amp;_th]:px-3 [&amp;_th]:py-2 [&amp;_th]:text-start [&amp;_th]:font-semibold [&amp;_th]:text-(--color-fg) [&amp;_td]:border-b [&amp;_td]:border-(--color-border) [&amp;_td]:px-3 [&amp;_td]:py-2 [&amp;_kbd]:rounded [&amp;_kbd]:border-hairline [&amp;_kbd]:border-(--color-border) [&amp;_kbd]:bg-(--color-surface-secondary) [&amp;_kbd]:px-1.5 [&amp;_kbd]:py-0.5 [&amp;_kbd]:text-caption [&amp;_kbd]:font-mono" data-testid="mdx-content"><div data-testid="mdx-rendered">## Executive Summary
+     "<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@graph":[{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"AILK AEO Strategy 2026","description":"In-depth research on answer engine optimization for AILK products.","mainEntity":{"@context":"https://schema.org","@type":"Article","headline":"AILK AEO Strategy 2026","description":"In-depth research on answer engine optimization for AILK products."}},{"@context":"https://schema.org","@type":"BreadcrumbList","inLanguage":"en","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http://localhost:3000/en/"},{"@type":"ListItem","position":2,"name":"Whitepapers","item":"http://localhost:3000/en/whitepapers"},{"@type":"ListItem","position":3,"name":"AILK AEO Strategy 2026","item":"http://localhost:3000/en/whitepapers/ailk-aeo-strategy-2026"}]}]}</script><main id="main"><div class="mx-auto w-full max-w-container-xl px-4 md:px-6 lg:px-8 py-section"><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div class="ailk-prose max-w-none text-(--color-text-muted) text-body-sm leading-relaxed [&amp;>*:first-child]:mt-0 [&amp;_h2]:mt-block-loose [&amp;_h2]:scroll-mt-24 [&amp;_h2]:text-heading-3 [&amp;_h2]:font-display [&amp;_h2]:text-(--color-fg) [&amp;_h3]:mt-block-loose [&amp;_h3]:scroll-mt-24 [&amp;_h3]:text-heading-4 [&amp;_h3]:font-display [&amp;_h3]:text-(--color-fg) [&amp;_h4]:mt-block-tight [&amp;_h4]:scroll-mt-24 [&amp;_h4]:text-heading-4 [&amp;_h4]:font-display [&amp;_h4]:text-(--color-fg) [&amp;_h5]:mt-block-tight [&amp;_h5]:scroll-mt-24 [&amp;_h5]:text-heading-4 [&amp;_h5]:font-display [&amp;_h5]:text-(--color-fg) [&amp;_h6]:mt-block-tight [&amp;_h6]:scroll-mt-24 [&amp;_h6]:text-heading-4 [&amp;_h6]:font-display [&amp;_h6]:text-(--color-fg) [&amp;_p]:mt-paragraph [&amp;_strong]:font-semibold [&amp;_strong]:text-(--color-fg) [&amp;_em]:italic [&amp;_ul]:mt-paragraph [&amp;_ul]:list-disc [&amp;_ul]:ps-6 [&amp;_ol]:mt-paragraph [&amp;_ol]:list-decimal [&amp;_ol]:ps-6 [&amp;_li]:mt-1 [&amp;_li]:ps-1 [&amp;_li]:marker:text-(--color-text-muted) [&amp;_li>ul]:mt-1 [&amp;_li>ol]:mt-1 [&amp;_blockquote]:mt-paragraph [&amp;_blockquote]:border-s-4 [&amp;_blockquote]:border-(--color-border-strong) [&amp;_blockquote]:ps-4 [&amp;_blockquote]:italic [&amp;_blockquote]:text-(--color-text-muted) [&amp;_hr]:my-block-loose [&amp;_hr]:border-(--color-border) [&amp;_a]:text-(--color-accent) [&amp;_a]:underline [&amp;_a]:underline-offset-4 [&amp;_:not(pre)>code]:rounded [&amp;_:not(pre)>code]:bg-(--color-surface-secondary) [&amp;_:not(pre)>code]:px-1.5 [&amp;_:not(pre)>code]:py-0.5 [&amp;_:not(pre)>code]:text-code [&amp;_:not(pre)>code]:font-mono [&amp;_:not(pre)>code]:text-(--color-fg) [&amp;_pre]:mt-paragraph [&amp;_pre]:overflow-auto [&amp;_pre]:rounded-md [&amp;_pre]:border-hairline [&amp;_pre]:border-(--color-border) [&amp;_pre]:bg-(--color-bg) [&amp;_pre]:p-4 [&amp;_pre]:font-mono [&amp;_pre]:text-body-sm [&amp;_img]:mt-paragraph [&amp;_img]:h-auto [&amp;_img]:max-w-full [&amp;_img]:rounded-lg [&amp;_table]:mt-paragraph [&amp;_table]:w-full [&amp;_table]:border-collapse [&amp;_table]:text-body-sm [&amp;_th]:border-b [&amp;_th]:border-(--color-border) [&amp;_th]:bg-(--color-surface-secondary) [&amp;_th]:px-3 [&amp;_th]:py-2 [&amp;_th]:text-start [&amp;_th]:font-semibold [&amp;_th]:text-(--color-fg) [&amp;_td]:border-b [&amp;_td]:border-(--color-border) [&amp;_td]:px-3 [&amp;_td]:py-2 [&amp;_kbd]:rounded [&amp;_kbd]:border-hairline [&amp;_kbd]:border-(--color-border) [&amp;_kbd]:bg-(--color-surface-secondary) [&amp;_kbd]:px-1.5 [&amp;_kbd]:py-0.5 [&amp;_kbd]:text-caption [&amp;_kbd]:font-mono" data-testid="mdx-content"><div data-testid="mdx-rendered">## Executive Summary
 
      Body content.</div></div></article></div></div></div></main>"
     `);

package/templates/apps/web/app/api/auth/hub/authorize/__tests__/route.test.ts

@@ -18,6 +18,10 @@
  * #9912 D3 (AC-1): a single `prompt=create` sends a visitor with no session to
  * `/sign-up` with the same continuation; any other value gives `/sign-in`, a
  * session ignores it, and it never enters the ref or the code request.
+ *
+ * #9966 D2 (AC-4): a person who has not said yes to the spoke is sent to the
+ * hub's consent page with a sealed ref; only that page's same-origin POST
+ * sends `consent: true` — the GET a spoke can trigger on page load never does.
  */
 
 // --- Mocks set up BEFORE imports ---
@@ -40,8 +44,8 @@ jest.mock("@working-theory/api-client", () => ({
 }));
 
 import { resolveNextPath } from "../../../../../[locale]/(auth)/sign-in/next-path";
-import { openContinuation } from "../../continuation";
-import { GET } from "../route";
+import { mintContinuation, openContinuation } from "../../continuation";
+import { GET, POST } from "../route";
 
 const HUB = "https://hub.example.com";
 const CONTINUE = "/api/auth/hub/continue";
@@ -577,3 +581,201 @@ describe("the sign-up hint, prompt=create (#9912 D3)", () => {
     expect(mockCreateCode.mock.calls[0]).toEqual(mockCreateCode.mock.calls[1]);
   });
 });
+
+describe("the consent step (#9966 D2, AC-4)", () => {
+  const SESSION_COOKIE = "better-auth.session_token=tok";
+  const CONSENT_REQUIRED = {
+    ok: false,
+    status: 403,
+    body: {
+      ok: false,
+      error: { code: "consent_required", message: "Consent required" },
+    },
+  };
+
+  /** A same-origin form post of `ref` fields from the hub's consent page. */
+  function post(
+    refs: string[],
+    headers: Record<string, string | undefined> = {},
+  ): Request {
+    const body = new URLSearchParams();
+    for (const ref of refs) body.append("ref", ref);
+    const sent: Record<string, string> = {
+      "content-type": "application/x-www-form-urlencoded",
+      cookie: SESSION_COOKIE,
+      "sec-fetch-site": "same-origin",
+      origin: HUB,
+    };
+    for (const [key, value] of Object.entries(headers)) {
+      if (value === undefined) delete sent[key];
+      else sent[key] = value;
+    }
+    return new Request(`${HUB}/api/auth/hub/authorize`, {
+      method: "POST",
+      headers: sent,
+      body: body.toString(),
+    });
+  }
+
+  const ref = (search = query(), now?: number) =>
+    mintContinuation(search, mockSecret, now);
+
+  it("GET: a session the API answers consent_required goes to /account/connect with a sealed ref, and sends no consent", async () => {
+    mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+    mockCreateCode.mockResolvedValue(CONSENT_REQUIRED);
+
+    const res = await GET(request(query(), { cookie: SESSION_COOKIE }));
+
+    expect(res.status).toBe(303);
+    const location = new URL(res.headers.get("location") ?? "", HUB);
+    expect(location.pathname).toBe("/account/connect");
+    const sealed = location.searchParams.get("ref") ?? "";
+    expect(openContinuation(sealed, mockSecret)).toBe(query());
+    expect(mockCreateCode).toHaveBeenCalledTimes(1);
+    const [body, init] = mockCreateCode.mock.calls[0] as [
+      Record<string, unknown>,
+      { headers: Record<string, string> },
+    ];
+    expect("consent" in body).toBe(false);
+    expect("x-internal-auth" in init.headers).toBe(false);
+  });
+
+  it("POST: a same-origin Continue mints with consent: true and 303s to the registered URI with code and state", async () => {
+    mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+    mockCreateCode.mockResolvedValue({
+      ok: true,
+      body: { code: CODE, redirectUri: SPOKE_CALLBACK },
+    });
+
+    const res = await POST(post([ref()]));
+
+    expect(res.status).toBe(303);
+    expect(res.headers.get("location")).toBe(
+      `${SPOKE_CALLBACK}?code=${CODE}&state=${STATE}`,
+    );
+    expect(res.headers.get("referrer-policy")).toBe("no-referrer");
+    expect(mockCreateCode).toHaveBeenCalledWith(
+      {
+        clientId: "spoke_abc",
+        redirectUri: SPOKE_CALLBACK,
+        codeChallenge: CHALLENGE,
+        consent: true,
+      },
+      { headers: { cookie: SESSION_COOKIE, origin: HUB } },
+    );
+  });
+
+  it("POST: carries x-internal-auth when the secret is set and the API is https:", async () => {
+    process.env = {
+      ...process.env,
+      OSS_API_INTERNAL_SECRET: "internal-secret",
+      AILK_API_URL: "https://api.example.com",
+    };
+    delete process.env.AILK_SPOKE_KEY;
+    mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+    mockCreateCode.mockResolvedValue({
+      ok: true,
+      body: { code: CODE, redirectUri: SPOKE_CALLBACK },
+    });
+
+    await POST(post([ref()]));
+
+    const [, init] = mockCreateCode.mock.calls[0] as [
+      unknown,
+      { headers: Record<string, string> },
+    ];
+    expect(init.headers["x-internal-auth"]).toBe("internal-secret");
+  });
+
+  it("POST: withholds x-internal-auth from a plain-http API", async () => {
+    process.env = {
+      ...process.env,
+      OSS_API_INTERNAL_SECRET: "internal-secret",
+      AILK_API_URL: "http://api.example.com",
+    };
+    mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+    mockCreateCode.mockResolvedValue({
+      ok: true,
+      body: { code: CODE, redirectUri: SPOKE_CALLBACK },
+    });
+
+    await POST(post([ref()]));
+
+    const [, init] = mockCreateCode.mock.calls[0] as [
+      unknown,
+      { headers: Record<string, string> },
+    ];
+    expect("x-internal-auth" in init.headers).toBe(false);
+  });
+
+  it.each([
+    ["no Sec-Fetch-Site", { "sec-fetch-site": undefined }],
+    ["Sec-Fetch-Site cross-site", { "sec-fetch-site": "cross-site" }],
+    ["Sec-Fetch-Site same-site", { "sec-fetch-site": "same-site" }],
+    ["a foreign Origin", { origin: "https://spoke.example.com" }],
+    ["no Origin", { origin: undefined }],
+    ["Origin: null", { origin: "null" }],
+  ])(
+    "POST: %s is 403 with no session read and no code",
+    async (_name, headers) => {
+      mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+
+      const res = await POST(post([ref()], headers));
+
+      expect(res.status).toBe(403);
+      expect(res.headers.get("location")).toBeNull();
+      expect(await res.json()).toEqual({ error: "invalid_request" });
+      expect(mockGetSession).not.toHaveBeenCalled();
+      expect(mockCreateCode).not.toHaveBeenCalled();
+    },
+  );
+
+  it.each([
+    ["a forged ref", () => ["x".repeat(80)]],
+    ["an expired ref", () => [ref(query(), Date.now() - 3_600_000)]],
+    ["two ref fields", () => [ref(), ref()]],
+    ["no ref field", () => []],
+    [
+      "a ref sealing a query that fails the schema",
+      () => [ref(query({ code_challenge_method: "plain" }))],
+    ],
+  ])("POST: %s is 400 with no code", async (_name, refs) => {
+    mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+
+    const res = await POST(post(refs()));
+
+    expect(res.status).toBe(400);
+    expect(res.headers.get("location")).toBeNull();
+    expect(mockCreateCode).not.toHaveBeenCalled();
+  });
+
+  it("POST: no session sends the visitor to sign in, back through the same continuation", async () => {
+    mockGetSession.mockResolvedValue(null);
+    const sealed = ref();
+
+    const res = await POST(post([sealed]));
+
+    expect(res.status).toBe(303);
+    expect(res.headers.get("location")).toBe(
+      `/sign-in?next=${encodeURIComponent(`${CONTINUE}/${sealed}`)}`,
+    );
+    expect(mockCreateCode).not.toHaveBeenCalled();
+  });
+
+  it("POST: an unverified email goes to /account/settings; any other refusal is a 400", async () => {
+    mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+    mockCreateCode.mockResolvedValueOnce({
+      ok: false,
+      status: 403,
+      body: { ok: false, error: { code: "email_unverified", message: "x" } },
+    });
+    const unverified = await POST(post([ref()]));
+    expect(unverified.status).toBe(303);
+    expect(unverified.headers.get("location")).toBe("/account/settings");
+
+    mockCreateCode.mockResolvedValueOnce(CONSENT_REQUIRED);
+    const refused = await POST(post([ref()]));
+    expect(refused.status).toBe(400);
+    expect(refused.headers.get("location")).toBeNull();
+  });
+});

package/templates/apps/web/app/api/auth/hub/authorize/route.ts

@@ -28,6 +28,11 @@
  *     the REGISTERED redirect URI the API echoes back, with `code` and the
  *     same `state` — never to the query's own `redirect_uri` until the API has
  *     confirmed it is the client's;
+ *   - a person who has not said yes to this spoke (403 `consent_required`,
+ *     #9966 D2) goes to the hub's own consent page, `/account/connect?ref=…`,
+ *     with the six keys sealed as the no-session branch seals them. The GET
+ *     never sends `consent`: a spoke can send a visitor here on page load, so
+ *     a GET must never be the yes;
  *   - a person whose email is not verified (403 `email_unverified`) goes to the
  *     hub's own `/account/settings`, whose For-you item says how to verify —
  *     never to the spoke;
@@ -51,6 +56,15 @@
  * continuation to `/sign-in` — nor a code or a cookie, and with a session it
  * is ignored: the person has an account, and the spoke signs them in.
  *
+ *   POST /api/auth/hub/authorize   (form field `ref`, #9966 D2)
+ *
+ *   - the consent page's Continue. Accepted only with `Sec-Fetch-Site:
+ *     same-origin` and an `Origin` equal to the pinned origin (a missing or
+ *     `null` Origin is refused), before any session read; the ref is opened
+ *     and its query re-validated, and the session branch runs as GET's does,
+ *     with `consent: true` — and `x-internal-auth` where the API requires it —
+ *     on the code request. This is the one call site that sends consent.
+ *
  * `BETTER_AUTH_URL` pins the `Origin` sent with the cookie-authenticated write
  * (Node's `fetch` sets none). Unset, the step answers 503: it needs a pinned
  * origin, exactly as the emailed link does.
@@ -64,13 +78,17 @@ import { hubSignIn } from "@working-theory/api-client";
 import {
   accountEmailHintSchema,
   hubAuthorizeQuerySchema,
+  type HubAuthorizeQuery,
 } from "@working-theory/validation";
 
 import { auth, resolveSecret } from "../../../../../auth";
+import { browserApiOrigin } from "../../../../../lib/api-origin.generated";
+import { TOPOLOGY } from "../../../../../lib/topology.generated";
 import {
   CONTINUATION_REF_MAX,
   CONTINUE_PATH,
   mintContinuation,
+  openContinuation,
 } from "../continuation";
 
 /** The six query keys, each read exactly once. */
@@ -86,6 +104,11 @@ const QUERY_KEYS = [
 /** Where an unverified person is sent to verify: the hub's own account page. */
 const VERIFY_EMAIL_PATH = "/account/settings";
 
+/** The hub's consent page, where a person says yes to one spoke (#9966 D2). */
+const CONSENT_PATH = "/account/connect";
+
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1"]);
+
 function json(status: number, error: string): Response {
   return new Response(JSON.stringify({ error }), {
     status,
@@ -120,42 +143,50 @@ function pinnedOrigin(): string | null {
   }
 }
 
-// platform-decisions-waiver: api-versioning — sign-in redirect endpoint, not a versioned API contract (spec 7894 §7)
-export async function GET(request: Request): Promise<Response> {
-  const url = new URL(request.url);
-
-  // Each declared key exactly once: a repeated key is ambiguous, so 400.
-  const raw: Record<string, string | undefined> = {};
-  for (const key of QUERY_KEYS) {
-    const values = url.searchParams.getAll(key);
-    if (values.length > 1) return json(400, "invalid_request");
-    raw[key] = values[0];
-  }
-  // #8757 D9 — the optional hint: the same once-only rule; refused → dropped.
-  const hints = url.searchParams.getAll("login_hint");
-  if (hints.length > 1) return json(400, "invalid_request");
-  // #9912 D3 — the sign-up hint, by the same rule; only `create` acts.
-  const prompts = url.searchParams.getAll("prompt");
-  if (prompts.length > 1) return json(400, "invalid_request");
-  const parsed = hubAuthorizeQuerySchema.safeParse(raw);
-  if (!parsed.success) return json(400, "invalid_request");
-  const query = parsed.data;
-  const hint = accountEmailHintSchema.safeParse(hints[0]);
+/** The six validated keys as a sealed continuation ref, or `null` past the cap. */
+function sealQuery(query: HubAuthorizeQuery): string | null {
+  // Only the six validated keys, in QUERY_KEYS order: a ref carries nothing
+  // that did not pass the schema, and extra or reordered keys are dropped.
+  const canonical = new URLSearchParams();
+  for (const key of QUERY_KEYS) canonical.set(key, query[key]);
+  const ref = mintContinuation(canonical.toString(), resolveSecret());
+  return ref.length > CONTINUATION_REF_MAX ? null : ref;
+}
 
-  const session = await auth.api.getSession({ headers: request.headers });
-  if (!session) {
-    // Only the six validated keys, in QUERY_KEYS order: a ref carries nothing
-    // that did not pass the schema, and extra or reordered keys are dropped.
-    const canonical = new URLSearchParams();
-    for (const key of QUERY_KEYS) canonical.set(key, query[key]);
-    const ref = mintContinuation(canonical.toString(), resolveSecret());
-    if (ref.length > CONTINUATION_REF_MAX) return json(400, "invalid_request");
-    const signIn = new URLSearchParams({ next: `${CONTINUE_PATH}/${ref}` });
-    if (prompts[0] === "create") return see(`/sign-up?${signIn.toString()}`);
-    if (hint.success) signIn.set("email", hint.data);
-    return see(`/sign-in?${signIn.toString()}`);
+/**
+ * `x-internal-auth` for the consent-bearing code request, under the Offerings
+ * buy route's `startHeaders` rule: only from a site that is not a spoke, and
+ * only to an `https:` or loopback API, so the secret never crosses a plain
+ * network hop. The API honours `consent: true` only beside it where it is set.
+ */
+function internalAuthHeader(): Record<string, string> {
+  const secret = process.env.OSS_API_INTERNAL_SECRET;
+  const spoke = TOPOLOGY === "spoke" || !!process.env.AILK_SPOKE_KEY?.trim();
+  if (!secret || spoke) return {};
+  try {
+    const api = new URL(
+      process.env.AILK_API_URL ||
+        browserApiOrigin() ||
+        process.env.NEXT_PUBLIC_API_URL ||
+        "http://localhost:3001",
+    );
+    const safe = api.protocol === "https:" || LOOPBACK_HOSTS.has(api.hostname);
+    return safe ? { "x-internal-auth": secret } : {};
+  } catch {
+    return {};
   }
+}
 
+/**
+ * The session branch, shared by GET and the consent POST: ask the API for a
+ * code and answer with where the visitor goes next. Only the POST passes
+ * `consent` (#9966 D2).
+ */
+async function codeRedirect(
+  request: Request,
+  query: HubAuthorizeQuery,
+  consent: boolean,
+): Promise<Response> {
   const origin = pinnedOrigin();
   if (origin === null) return json(503, "temporarily_unavailable");
 
@@ -166,11 +197,13 @@ export async function GET(request: Request): Promise<Response> {
         clientId: query.client_id,
         redirectUri: query.redirect_uri,
         codeChallenge: query.code_challenge,
+        ...(consent ? { consent: true as const } : {}),
       },
       {
         headers: {
           cookie: request.headers.get("cookie") ?? "",
           origin,
+          ...(consent ? internalAuthHeader() : {}),
         },
       },
     );
@@ -198,5 +231,90 @@ export async function GET(request: Request): Promise<Response> {
   if (result.status === 403 && code === "email_unverified") {
     return see(VERIFY_EMAIL_PATH);
   }
+  // Not yet said yes to this spoke: ask, on the hub's own page. The POST that
+  // page sends already carries consent, so it never comes back here.
+  if (!consent && result.status === 403 && code === "consent_required") {
+    const ref = sealQuery(query);
+    if (ref === null) return json(400, "invalid_request");
+    return see(`${CONSENT_PATH}?${new URLSearchParams({ ref }).toString()}`);
+  }
   return json(400, "invalid_request");
 }
+
+// platform-decisions-waiver: api-versioning — sign-in redirect endpoint, not a versioned API contract (spec 7894 §7)
+export async function GET(request: Request): Promise<Response> {
+  const url = new URL(request.url);
+
+  // Each declared key exactly once: a repeated key is ambiguous, so 400.
+  const raw: Record<string, string | undefined> = {};
+  for (const key of QUERY_KEYS) {
+    const values = url.searchParams.getAll(key);
+    if (values.length > 1) return json(400, "invalid_request");
+    raw[key] = values[0];
+  }
+  // #8757 D9 — the optional hint: the same once-only rule; refused → dropped.
+  const hints = url.searchParams.getAll("login_hint");
+  if (hints.length > 1) return json(400, "invalid_request");
+  // #9912 D3 — the sign-up hint, by the same rule; only `create` acts.
+  const prompts = url.searchParams.getAll("prompt");
+  if (prompts.length > 1) return json(400, "invalid_request");
+  const parsed = hubAuthorizeQuerySchema.safeParse(raw);
+  if (!parsed.success) return json(400, "invalid_request");
+  const query = parsed.data;
+  const hint = accountEmailHintSchema.safeParse(hints[0]);
+
+  const session = await auth.api.getSession({ headers: request.headers });
+  if (!session) {
+    const ref = sealQuery(query);
+    if (ref === null) return json(400, "invalid_request");
+    const signIn = new URLSearchParams({ next: `${CONTINUE_PATH}/${ref}` });
+    if (prompts[0] === "create") return see(`/sign-up?${signIn.toString()}`);
+    if (hint.success) signIn.set("email", hint.data);
+    return see(`/sign-in?${signIn.toString()}`);
+  }
+
+  return codeRedirect(request, query, false);
+}
+
+/**
+ * The consent page's Continue (#9966 D2): the one request that says yes to a
+ * spoke. Same-origin only, decided before any session read, so neither a
+ * cross-site form nor a sandboxed frame (`Origin: null`) can post it.
+ */
+export async function POST(request: Request): Promise<Response> {
+  const origin = pinnedOrigin();
+  if (origin === null) return json(503, "temporarily_unavailable");
+  const sent = request.headers.get("origin");
+  if (
+    request.headers.get("sec-fetch-site") !== "same-origin" ||
+    sent === null ||
+    sent !== origin
+  ) {
+    return json(403, "invalid_request");
+  }
+
+  let refs: FormDataEntryValue[];
+  try {
+    refs = (await request.formData()).getAll("ref");
+  } catch {
+    return json(400, "invalid_request");
+  }
+  const [ref] = refs;
+  if (refs.length !== 1 || typeof ref !== "string") {
+    return json(400, "invalid_request");
+  }
+  const search = openContinuation(ref, resolveSecret());
+  if (search === null) return json(400, "invalid_request");
+  const params = new URLSearchParams(search);
+  const raw: Record<string, string | undefined> = {};
+  for (const key of QUERY_KEYS) raw[key] = params.get(key) ?? undefined;
+  const parsed = hubAuthorizeQuerySchema.safeParse(raw);
+  if (!parsed.success) return json(400, "invalid_request");
+
+  const session = await auth.api.getSession({ headers: request.headers });
+  if (!session) {
+    const signIn = new URLSearchParams({ next: `${CONTINUE_PATH}/${ref}` });
+    return see(`/sign-in?${signIn.toString()}`);
+  }
+  return codeRedirect(request, parsed.data, true);
+}