create-ailk 0.27.0 → 0.28.1

package/templates/apps/web/lib/__tests__/site-header.test.ts

@@ -0,0 +1,151 @@
+/**
+ * The site's header settings (#10046) — `readSiteHeader` over a fixture
+ * `_site.mdx` set through `AILK_CONTENT_ROOT` (AC-2), and the pure
+ * `signedOutHeaderActions` composition over the generated auth pair (AC-3).
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import type * as SiteHeaderModule from "../site-header";
+
+let root: string;
+const previousRoot = process.env.AILK_CONTENT_ROOT;
+let mod: typeof SiteHeaderModule;
+let warn: jest.SpyInstance;
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "site-header-"));
+  process.env.AILK_CONTENT_ROOT = root;
+  // A fresh module per test so the warn-once flag starts clear.
+  jest.isolateModules(() => {
+    mod = require("../site-header") as typeof SiteHeaderModule;
+  });
+  warn = jest.spyOn(console, "warn").mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+  warn.mockRestore();
+  rmSync(root, { recursive: true, force: true });
+  if (previousRoot === undefined) delete process.env.AILK_CONTENT_ROOT;
+  else process.env.AILK_CONTENT_ROOT = previousRoot;
+});
+
+function writeSite(frontmatter: string): void {
+  writeFileSync(join(root, "_site.mdx"), `---\n${frontmatter}\n---\n`);
+}
+
+describe("readSiteHeader (#10046 AC-2)", () => {
+  it("returns the parsed header for a valid one", () => {
+    writeSite(
+      [
+        "siteName: Acme",
+        "header:",
+        "  cta:",
+        "    label: Start here",
+        "    href: /diagnostic",
+        "  signIn: hidden",
+      ].join("\n"),
+    );
+    expect(mod.readSiteHeader()).toEqual({
+      cta: { label: "Start here", href: "/diagnostic" },
+      signIn: "hidden",
+    });
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it("returns undefined silently when _site.mdx is absent", () => {
+    expect(mod.readSiteHeader()).toBeUndefined();
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it("returns undefined silently when _site.mdx has no header", () => {
+    writeSite("siteName: Acme");
+    expect(mod.readSiteHeader()).toBeUndefined();
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it("returns undefined and warns once, naming the field and never the value", () => {
+    writeSite(
+      ["siteName: Acme", "header:", "  cta:", "    label: Go", "    href: javascript:x"].join("\n"),
+    );
+    expect(mod.readSiteHeader()).toBeUndefined();
+    expect(mod.readSiteHeader()).toBeUndefined();
+    expect(warn).toHaveBeenCalledTimes(1);
+    const message = String(warn.mock.calls[0]?.[0]);
+    expect(message).toContain("cta");
+    expect(message).not.toContain("javascript");
+  });
+
+  it("a bad header.style never drops the cta, and is not this reader's warning (#10049 AC-4)", () => {
+    writeSite(
+      [
+        "siteName: Acme",
+        "header:",
+        "  style: minimal",
+        "  cta:",
+        "    label: Start here",
+        "    href: /diagnostic",
+      ].join("\n"),
+    );
+    expect(mod.readSiteHeader()).toEqual({
+      cta: { label: "Start here", href: "/diagnostic" },
+    });
+    expect(warn).not.toHaveBeenCalled();
+  });
+});
+
+describe("signedOutHeaderActions (#10046 AC-3)", () => {
+  const cta = { label: "Start here", href: "/diagnostic" };
+  const hubPair = [
+    { labelKey: "signIn", path: "/sign-in", variant: "outline-strong" as const },
+    { labelKey: "signUp", path: "/sign-up", variant: "primary" as const },
+  ];
+  const ctaAction = { labelKey: "headerCta", path: "/diagnostic", variant: "primary" };
+
+  function frozenCopy<T>(value: T): T {
+    return JSON.parse(JSON.stringify(value)) as T;
+  }
+
+  it("with no header, or signIn without a cta, returns the pair unchanged", () => {
+    const before = frozenCopy(hubPair);
+    expect(mod.signedOutHeaderActions(undefined, hubPair)).toEqual(hubPair);
+    expect(mod.signedOutHeaderActions({ signIn: "hidden" }, hubPair)).toEqual(hubPair);
+    expect(hubPair).toEqual(before);
+  });
+
+  it("with a cta, returns a ghost Sign in then the cta, and drops Sign up", () => {
+    const before = frozenCopy(hubPair);
+    expect(mod.signedOutHeaderActions({ cta }, hubPair)).toEqual([
+      { labelKey: "signIn", path: "/sign-in", variant: "ghost" },
+      ctaAction,
+    ]);
+    expect(hubPair).toEqual(before);
+  });
+
+  it("with a cta and signIn hidden, returns only the cta", () => {
+    const before = frozenCopy(hubPair);
+    expect(mod.signedOutHeaderActions({ cta, signIn: "hidden" }, hubPair)).toEqual([ctaAction]);
+    expect(hubPair).toEqual(before);
+  });
+
+  it("on a hub spoke, restyles the /account Sign in link", () => {
+    const spokePair = [{ labelKey: "signIn", path: "/account", variant: "outline-strong" as const }];
+    const before = frozenCopy(spokePair);
+    expect(mod.signedOutHeaderActions({ cta }, spokePair)).toEqual([
+      { labelKey: "signIn", path: "/account", variant: "ghost" },
+      ctaAction,
+    ]);
+    expect(spokePair).toEqual(before);
+  });
+
+  it("on a spoke without sign-in, returns only the cta", () => {
+    const none: typeof hubPair = [];
+    expect(mod.signedOutHeaderActions({ cta }, none)).toEqual([ctaAction]);
+    expect(none).toEqual([]);
+  });
+
+  it("exports the label key the cta action carries", () => {
+    expect(mod.HEADER_CTA_LABEL_KEY).toBe("headerCta");
+  });
+});

package/templates/apps/web/lib/__tests__/structured-data.test.tsx

@@ -30,7 +30,17 @@
  * reads the same files with the same frontmatter schema the manifest is
  * compiled from. See docs/internal/decisions/scaffold-structured-data-check.md.
  */
-import { existsSync, readdirSync, readFileSync } from "node:fs";
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 
 import { render } from "@testing-library/react";
@@ -61,6 +71,7 @@ import { parse as parseYaml } from "yaml";
 
 // Registers the site's `_site.mdx` identity at module load, as the `[locale]`
 // layout does in production (#6597).
+import { MARKETING_PAGES } from "../modules.generated";
 import { readSiteIdentity } from "../site-identity";
 
 // Detail routes call notFound() on a missing page; a thrown error is how the
@@ -537,21 +548,51 @@ function routeIdentity(
   return null;
 }
 
+/**
+ * The hub's own slug a `<dir>/[slug]` route must not render (#10044 D13):
+ * when `<dir>/page.tsx` renders a fixed `renderPage({ type, slug: "<literal>" })`
+ * of the SAME type as the dynamic route, that page is the hub's own, served at
+ * `<dir>` — `/pricing`'s `pricing.mdx`, never `/pricing/pricing`. Keyed on
+ * the parent directory, not the type alone: `launch-service` renders a
+ * `Service` that `/services/[slug]` must still render.
+ */
+function hubOwnSlug(file: string, type: string): string | null {
+  if (basename(dirname(file)) !== "[slug]") return null;
+  const parent = join(dirname(dirname(file)), "page.tsx");
+  if (!existsSync(parent)) return null;
+  const identity = routeIdentity(readFileSync(parent, "utf8"));
+  return identity !== null && identity.type === type ? identity.slug : null;
+}
+
 type PageModule = {
   default: (props: {
-    params: Promise<{ locale: string; slug?: string; detail?: string }>;
+    params: Promise<{
+      locale: string;
+      slug?: string;
+      detail?: string;
+      child?: string;
+    }>;
   }) => Promise<ReactElement>;
 };
 
+/** #10043 D7 — a Service under its category, `/services/<parent>/<slug>`. */
+const NESTED_SERVICE_ROUTE = "services/[slug]/[child]";
+
 async function renderRoute(
   file: string,
   route: string,
   slug: string | undefined,
+  parent?: string,
 ): Promise<HTMLElement> {
   // Resolved at test time from the walk above — a static import would dangle
   // in a scaffold that gated the surface off.
   const mod = require(file) as PageModule;
-  const params: { locale: string; slug?: string; detail?: string } = {
+  const params: {
+    locale: string;
+    slug?: string;
+    detail?: string;
+    child?: string;
+  } = {
     locale: DEFAULT_LOCALE,
   };
   // #6897 D2 — params are built from the route's OWN dynamic segments: the
@@ -561,6 +602,10 @@ async function renderRoute(
   if (route === "[slug]/[detail]") {
     params.slug = MEET_PLACEHOLDER_HUB;
     if (slug !== undefined) params.detail = slug;
+  } else if (route === NESTED_SERVICE_ROUTE) {
+    // #10043 D7 — the category rides `slug`, the service `child`.
+    if (parent !== undefined) params.slug = parent;
+    if (slug !== undefined) params.child = slug;
   } else if (slug !== undefined) {
     params.slug = slug;
   }
@@ -578,6 +623,14 @@ describe("structured data — every route emits a valid JSON-LD script", () => {
   it.each(routes)("$route", async ({ route, file }) => {
     const label = `/${DEFAULT_LOCALE}${route === "" ? "" : "/" + route}`;
     const src = readFileSync(file, "utf8");
+    // #10040 decision 1 — without the marketing module `/` redirects to
+    // /account before any content: no HomePage seed, no JSON-LD, and its
+    // page.tsx still names renderPage, so it is skipped here rather than
+    // listed in NO_STRUCTURED_DATA_ROUTES (which refuses a renderPage route).
+    if (route === "" && !MARKETING_PAGES) {
+      console.info(`structured-data: ${label} not checked — no marketing module, / redirects to /account (#10040)`);
+      return;
+    }
     const exempt = exemption(route, src);
     const identity = routeIdentity(src);
     if (exempt !== undefined) {
@@ -608,6 +661,8 @@ describe("structured data — every route emits a valid JSON-LD script", () => {
     // site, not a route with nothing to check. A `[slug]` route with no
     // pages of its type is simply empty — say so, do not fail.
     let slugs: string[];
+    // #10043 D7 — a Service's category, for the nested route's params.
+    const parents = new Map<string, string>();
     if (identity.slug !== null) {
       const page = await adapter.getPageSource(
         type,
@@ -621,9 +676,22 @@ describe("structured data — every route emits a valid JSON-LD script", () => {
       }
       slugs = [identity.slug];
     } else {
-      slugs = (await adapter.listDetail(type, DEFAULT_LOCALE)).map(
-        (p: ContentPage) => p.slug,
+      // The hub's own page shares this route's type but is served at the hub
+      // (#10044 D13), so it is never rendered here.
+      const hubSlug = hubOwnSlug(file, type);
+      const pages = (await adapter.listDetail(type, DEFAULT_LOCALE)).filter(
+        (p: ContentPage) => p.slug !== hubSlug,
       );
+      for (const p of pages) if (p.parent !== undefined) parents.set(p.slug, p.parent);
+      // #10043 D7 — a Service with a `parent` is served at the nested route
+      // only (its flat URL redirects there); every other one at `[slug]`.
+      const served =
+        route === NESTED_SERVICE_ROUTE
+          ? pages.filter((p: ContentPage) => p.parent !== undefined)
+          : route === "services/[slug]"
+            ? pages.filter((p: ContentPage) => p.parent === undefined)
+            : pages;
+      slugs = served.map((p: ContentPage) => p.slug);
       if (slugs.length === 0) {
         console.info(
           `structured-data: ${label} has no ${type} content in ${DEFAULT_LOCALE}; every slug serves 404 in production — nothing to check`,
@@ -638,13 +706,16 @@ describe("structured data — every route emits a valid JSON-LD script", () => {
         file,
         route,
         identity.slug === null ? slug : undefined,
+        parents.get(slug),
       );
       const blocks = extractJsonLdBlocks(container);
       const pageLabel =
         identity.slug === null
           ? route === "[slug]/[detail]"
             ? `/${DEFAULT_LOCALE}/${MEET_PLACEHOLDER_HUB}/${slug}`
-            : `${label.replace(/\[slug\]$/, "")}${slug}`
+            : route === NESTED_SERVICE_ROUTE
+              ? `/${DEFAULT_LOCALE}/services/${parents.get(slug)}/${slug}`
+              : `${label.replace(/\[slug\]$/, "")}${slug}`
           : label;
       if (blocks.length === 0) {
         failures.push(
@@ -661,6 +732,77 @@ describe("structured data — every route emits a valid JSON-LD script", () => {
   });
 });
 
+// ── 1b. A hub whose own page shares its detail type (#10044 D13) ───────────
+
+describe("structured data — a hub's own page is not rendered at its detail route (#10044 AC-6)", () => {
+  const dynamicRoutes = walkRoutes(ROUTE_ROOT).flatMap(({ route, file }) => {
+    const identity = routeIdentity(readFileSync(file, "utf8"));
+    return identity !== null && identity.slug === null
+      ? [{ route, file, type: identity.type }]
+      : [];
+  });
+
+  it("drops exactly Pricing/pricing, and only when the pricing route family is present", () => {
+    const dropped = dynamicRoutes.flatMap(({ file, type }) => {
+      const slug = hubOwnSlug(file, type);
+      return slug === null ? [] : [`${type}/${slug}`];
+    });
+    const hasPricingFamily = dynamicRoutes.some(
+      ({ route }) => route === "pricing/[slug]",
+    );
+    expect(dropped).toEqual(hasPricingFamily ? ["Pricing/pricing"] : []);
+  });
+
+  // Only where the route family ships (a scaffold may gate /pricing off).
+  const pricingDetail = dynamicRoutes.find(
+    ({ route }) => route === "pricing/[slug]",
+  );
+  (pricingDetail === undefined ? it.skip : it)(
+    "renders and validates an offering pricing page, never the hub's own file",
+    async () => {
+      const root = mkdtempSync(join(tmpdir(), "ailk-10044-sd-"));
+      const prior = process.env.AILK_CONTENT_ROOT;
+      try {
+        mkdirSync(join(root, DEFAULT_LOCALE, "Pricing"), { recursive: true });
+        copyFileSync(join(CONTENT_ROOT, "_site.mdx"), join(root, "_site.mdx"));
+        writeFileSync(
+          join(root, DEFAULT_LOCALE, "Pricing", "pricing.mdx"),
+          '---\ntype: "Pricing"\nslug: "pricing"\ntitle: "Pricing"\ndescription: "Plans."\n---\n',
+        );
+        writeFileSync(
+          join(root, DEFAULT_LOCALE, "Pricing", "website-rebuild.mdx"),
+          '---\ntype: "Pricing"\nslug: "website-rebuild"\ntitle: "Website Rebuild"\ndescription: "What a rebuild costs."\nplans: ["ss-website-rebuild"]\n---\n',
+        );
+        process.env.AILK_CONTENT_ROOT = root;
+        const fixtureAdapter = createMdxAdapter({
+          contentRoot: root,
+          defaultLocale: DEFAULT_LOCALE,
+        });
+        const hubSlug = hubOwnSlug(pricingDetail!.file, "Pricing");
+        const slugs = (await fixtureAdapter.listDetail("Pricing", DEFAULT_LOCALE))
+          .map((p: ContentPage) => p.slug)
+          .filter((slug: string) => slug !== hubSlug);
+        expect(slugs).toEqual(["website-rebuild"]);
+
+        const label = `/${DEFAULT_LOCALE}/pricing/website-rebuild`;
+        const container = await renderRoute(
+          pricingDetail!.file,
+          "pricing/[slug]",
+          "website-rebuild",
+        );
+        const blocks = extractJsonLdBlocks(container);
+        expect(blocks.length).toBeGreaterThan(0);
+        expect(validateFor(blocks, "Pricing", label)).toBeNull();
+        expect(identityFailure(blocks, label)).toBeNull();
+      } finally {
+        if (prior === undefined) delete process.env.AILK_CONTENT_ROOT;
+        else process.env.AILK_CONTENT_ROOT = prior;
+        rmSync(root, { recursive: true, force: true });
+      }
+    },
+  );
+});
+
 // ── 2a. exemption(route, src) — the generated-checkout routes (#8513) ──────
 //
 // Proof that the two conditional entries above key on the FILE, not the

package/templates/apps/web/lib/__tests__/telemetry-scrub.test.ts

@@ -0,0 +1,84 @@
+// #9162 (PR #9152's security review) — the deliverable grant id in the PATH of
+// `<hub>/v1/deliverables/<grantId>`, which `deliverables.openGrant` fetches
+// server-side, is redacted before a URL reaches Sentry. The query-param scrub
+// has its own suite, `__tests__/telemetry-scrub.test.ts`.
+
+import { scrubTelemetryUrl } from "../telemetry-scrub";
+
+const GRANT = "dgrant_01920000-0000-7000-8000-000000000001";
+
+describe("scrubTelemetryUrl — the /v1/deliverables/<grantId> path (#9162)", () => {
+  it("redacts the grant id of an absolute hub URL", () => {
+    expect(
+      scrubTelemetryUrl(`https://hub.example.com/v1/deliverables/${GRANT}`),
+    ).toBe("https://hub.example.com/v1/deliverables/:grantId");
+  });
+
+  it("redacts the grant id of a relative URL", () => {
+    expect(scrubTelemetryUrl(`/v1/deliverables/${GRANT}`)).toBe(
+      "/v1/deliverables/:grantId",
+    );
+  });
+
+  it("keeps the query string and fragment around the redacted id", () => {
+    expect(
+      scrubTelemetryUrl(
+        `https://hub.example.com/v1/deliverables/${GRANT}?x=1#top`,
+      ),
+    ).toBe("https://hub.example.com/v1/deliverables/:grantId?x=1#top");
+  });
+
+  it("redacts the id and strips a token query param together", () => {
+    const out = scrubTelemetryUrl(
+      `https://hub.example.com/v1/deliverables/${GRANT}?g=${GRANT}&x=1`,
+    );
+    expect(out).toBe("https://hub.example.com/v1/deliverables/:grantId?x=1");
+    expect(out).not.toContain(GRANT);
+  });
+
+  it("redacts an id the api-client percent-encoded", () => {
+    const out = scrubTelemetryUrl(
+      `https://hub.example.com/v1/deliverables/${encodeURIComponent("a b%c")}`,
+    );
+    expect(out).toBe("https://hub.example.com/v1/deliverables/:grantId");
+  });
+
+  it("redacts the id under an API base path", () => {
+    expect(
+      scrubTelemetryUrl(`https://hub.example.com/api/v1/deliverables/${GRANT}`),
+    ).toBe("https://hub.example.com/api/v1/deliverables/:grantId");
+  });
+
+  it("redacts the id inside a span description (`METHOD url`)", () => {
+    expect(
+      scrubTelemetryUrl(`GET https://hub.example.com/v1/deliverables/${GRANT}`),
+    ).toBe("GET https://hub.example.com/v1/deliverables/:grantId");
+  });
+
+  it("leaves the ungated open read's slug alone — a slug is not a credential", () => {
+    for (const url of [
+      "https://hub.example.com/v1/deliverables/open/q3",
+      "/v1/deliverables/open/q3?x=1",
+      "GET https://hub.example.com/v1/deliverables/open/q3",
+    ]) {
+      expect(scrubTelemetryUrl(url)).toBe(url);
+    }
+  });
+
+  it("redacts a grant id that only starts with `open`", () => {
+    expect(scrubTelemetryUrl("/v1/deliverables/openly_a_grant")).toBe(
+      "/v1/deliverables/:grantId",
+    );
+  });
+
+  it("leaves other paths unchanged", () => {
+    for (const url of [
+      "https://hub.example.com/v1/deliverables",
+      "https://hub.example.com/v1/deliverables/",
+      "/v1/leads/submit",
+      `/reports/q3/file`,
+    ]) {
+      expect(scrubTelemetryUrl(url)).toBe(url);
+    }
+  });
+});

package/templates/apps/web/lib/__tests__/template-listing.test.ts

@@ -0,0 +1,158 @@
+/**
+ * The template-listing mapping (#10051 D6, AC-6) — a TemplatePage's
+ * frontmatter to a hub card, an action label and the detail page's
+ * generated sections. Pure; no I/O.
+ */
+import { PageSectionsSchema } from "@working-theory/validation";
+
+import {
+  templateActionLabel,
+  templateCard,
+  templateDetailSections,
+  type TemplateLabels,
+} from "../template-listing";
+
+const labels: TemplateLabels = {
+  getIt: "Get it",
+  startFree: "Start free",
+  viewDemo: "View demo",
+  viewTemplate: "View template",
+  included: "What's included",
+  demoBadge: "Live demo",
+  moreCategories: (count) => `+${count} more`,
+};
+
+const full = {
+  slug: "a",
+  frontmatter: {
+    title: "Template A",
+    description: "Description A.",
+    summary: "Summary A.",
+    thumbnail: "/img/a.png",
+    categories: ["accounting", "not-a-category", "legal"],
+    demoUrl: "https://a.salessmyth.com",
+    getItUrl: "/contact",
+    price: 0,
+    includes: [
+      { title: "Base site", description: "Pages and structured data." },
+    ],
+  },
+};
+
+const bare = {
+  slug: "b",
+  frontmatter: {
+    title: "Template B",
+    description: "Description B.",
+    getItUrl: "https://buy.example.com/b",
+    includes: [
+      { title: "Base site", description: "Pages and structured data." },
+    ],
+  },
+};
+
+describe("templateCard", () => {
+  it("maps every present field", () => {
+    expect(templateCard(full, labels)).toEqual({
+      title: "Template A",
+      description: "Summary A.",
+      image: { src: "/img/a.png", alt: "Template A" },
+      eyebrow: "Accounting · Legal",
+      badge: "Live demo",
+      link: { label: "View template", href: "/templates/a" },
+    });
+  });
+
+  it("omits image, eyebrow and badge when their fields are absent, and falls back to description", () => {
+    expect(templateCard(bare, labels)).toEqual({
+      title: "Template B",
+      description: "Description B.",
+      link: { label: "View template", href: "/templates/b" },
+    });
+  });
+
+  it("omits the eyebrow when every category slug is unknown", () => {
+    const card = templateCard(
+      { slug: "c", frontmatter: { ...bare.frontmatter, categories: ["nope"] } },
+      labels,
+    );
+    expect(card).not.toHaveProperty("eyebrow");
+  });
+
+  it("shows at most three category names, then +N more", () => {
+    const card = templateCard(
+      {
+        slug: "d",
+        frontmatter: {
+          ...bare.frontmatter,
+          categories: ["accounting", "legal", "consulting", "hvac", "roofing"],
+        },
+      },
+      labels,
+    );
+    expect(card.eyebrow).toBe("Accounting · Legal · Consulting · +2 more");
+  });
+});
+
+describe("templateActionLabel", () => {
+  it("is Start free only for a price of exactly 0", () => {
+    expect(templateActionLabel(0, labels)).toBe("Start free");
+    expect(templateActionLabel(undefined, labels)).toBe("Get it");
+    expect(templateActionLabel(5, labels)).toBe("Get it");
+  });
+});
+
+describe("templateDetailSections", () => {
+  it("builds a hero and a What's included section", () => {
+    const [hero, included] = templateDetailSections(full.frontmatter, labels);
+    expect(hero).toMatchObject({
+      type: "hero",
+      data: {
+        headline: "Template A",
+        subheadline: "Summary A.",
+        eyebrow: "Accounting · Legal",
+        image: { src: "/img/a.png", alt: "Template A" },
+        primaryCta: { label: "Start free", href: "/contact" },
+        secondaryCta: {
+          label: "View demo",
+          href: "https://a.salessmyth.com",
+          variant: "outline",
+        },
+      },
+    });
+    expect(included).toEqual({
+      type: "items",
+      id: "template-included",
+      data: {
+        headline: "What's included",
+        variant: "minimal",
+        items: [
+          { title: "Base site", description: "Pages and structured data." },
+        ],
+      },
+    });
+  });
+
+  it("omits the demo link, image and eyebrow when absent", () => {
+    const [hero] = templateDetailSections(bare.frontmatter, labels);
+    const data = (hero as { data: Record<string, unknown> }).data;
+    expect(data.primaryCta).toEqual({
+      label: "Get it",
+      href: "https://buy.example.com/b",
+    });
+    expect(data).not.toHaveProperty("secondaryCta");
+    expect(data).not.toHaveProperty("image");
+    expect(data).not.toHaveProperty("eyebrow");
+    expect(data.subheadline).toBe("Description B.");
+  });
+
+  it.each([
+    ["full", full.frontmatter],
+    ["bare", bare.frontmatter],
+  ])("the %s result parses PageSectionsSchema", (_label, frontmatter) => {
+    expect(
+      PageSectionsSchema.safeParse(templateDetailSections(frontmatter, labels))
+        .success,
+    ).toBe(true);
+  });
+});

package/templates/apps/web/lib/auth-secret.ts

@@ -0,0 +1,57 @@
+/**
+ * auth-secret.ts — `resolveSecret()`, moved verbatim out of `auth.ts`
+ * (#8556, spec docs/specs/9965-sweep-a-trust-or-authz-spec.md D7) so a
+ * consumer that only needs the secret does not load Better Auth, which is
+ * ESM-only. `auth.ts` re-exports it, so every existing import is unchanged.
+ */
+
+/**
+ * Resolve the secret used to sign session cookies AND — since #5962 § D9 — the
+ * email-verification JWTs.
+ *
+ * THROWS in production when BETTER_AUTH_SECRET is unset (§ D16). Better Auth's
+ * own `validateSecret` throws only when the secret equals ITS default; this
+ * repo's literal is a different string, so it cleared that check and produced
+ * nothing but a low-entropy warning — while sitting in a repository whose
+ * `oss`-tier tree ships publicly. Anyone who can read this file could forge
+ * both a session cookie and a verification token on any deployment that
+ * omitted the variable.
+ *
+ * This changes boot behaviour: a production deployment with no
+ * BETTER_AUTH_SECRET boots today and does not after this. That is the correct
+ * failure — a site signing sessions with a published string is not usefully
+ * "up" — and `apps/web/.env.example` has always documented the variable as
+ * REQUIRED in production. The change makes the file honest rather than adding
+ * a requirement.
+ *
+ * Exported (#8146 D5) so the hub's sign-in continuation seals its ref under the
+ * same resolved secret instead of re-reading the variable: the second consumer
+ * after `betterAuth({ secret })`.
+ */
+export function resolveSecret(): string {
+  const configured = process.env.BETTER_AUTH_SECRET;
+  if (configured) return configured;
+
+  // SERVING, not BUILDING. `next build` collects page data with
+  // NODE_ENV=production, and that evaluates `app/api/auth/[...all]/route.ts`,
+  // which resolves the lazy `auth` proxy — so an unqualified production throw
+  // fails the BUILD of any tree that has not set the variable. That is much
+  // broader than the risk: a build produces an artifact, it does not serve a
+  // session, and it would break CI, preview builds, and `pnpm build` on a
+  // freshly scaffolded site that has not configured auth at all.
+  //
+  // Next sets NEXT_PHASE to PHASE_PRODUCTION_BUILD ("phase-production-build")
+  // for the duration of the build, so excluding that phase keeps the guard
+  // exactly where it was aimed: a production process that is about to answer
+  // requests. Such a process still throws on the first access to `auth`, which
+  // is the intended failure — a site signing sessions with a string published
+  // in this repository is not usefully "up".
+  const isBuildPhase = process.env.NEXT_PHASE === "phase-production-build";
+  if (process.env.NODE_ENV === "production" && !isBuildPhase) {
+    throw new Error(
+      "BETTER_AUTH_SECRET is required in production: it signs session cookies and email-verification tokens, and the development fallback is published in this repository.",
+    );
+  }
+
+  return "ailk-dev-fallback-secret-published-in-this-repo-never-use-in-production";
+}