create-ailk 0.29.1 → 0.31.0

package/templates/apps/web/app/[locale]/(auth)/consent/consent-form.tsx

@@ -0,0 +1,132 @@
+"use client"; // the workspace choice decides which scopes show and whether Allow is enabled
+
+/**
+ * The consent page's client island (#10357 D6): the workspace radio list, the
+ * chosen workspace's offered scopes as checkboxes — none ticked — and Allow,
+ * disabled until a workspace is chosen. Deliberate selection is the defence
+ * against a phished authorization (SEC-10357-11, -13). Strings arrive
+ * translated from the server page.
+ */
+import {
+  Button,
+  Checkbox,
+  Input,
+  Label,
+  RadioGroup,
+  RadioGroupItem,
+  Text,
+} from "@working-theory/ui/primitives";
+import type { ReactElement } from "react";
+import { useState } from "react";
+
+import { decideConsent } from "./consent.actions";
+
+export interface ConsentWorkspace {
+  id: string;
+  name: string;
+  organizationName: string;
+  /** Each offered scope with its label. */
+  offered: Array<{ scope: string; permission: string; label: string }>;
+}
+
+export interface ConsentFormText {
+  workspaceLegend: string;
+  scopesLegend: string;
+  memberReads: string;
+  noScopes: string;
+  allow: string;
+  deny: string;
+}
+
+export interface ConsentFormProps {
+  consentCode: string;
+  locale: string;
+  workspaces: ConsentWorkspace[];
+  text: ConsentFormText;
+}
+
+export function ConsentForm({ consentCode, locale, workspaces, text }: ConsentFormProps): ReactElement {
+  const [workspaceId, setWorkspaceId] = useState<string>(
+    workspaces.length === 1 ? (workspaces[0]?.id ?? "") : "",
+  );
+  const chosen = workspaces.find((w) => w.id === workspaceId);
+
+  return (
+    <form action={decideConsent} className="flex flex-col gap-6" data-testid="mcp-consent-form">
+      <Input type="hidden" name="consent_code" value={consentCode} />
+      <Input type="hidden" name="locale" value={locale} />
+      {workspaces.length > 0 ? (
+        <div className="flex flex-col gap-3">
+          <Text as="p" variant="body-sm" className="font-semibold">
+            {text.workspaceLegend}
+          </Text>
+          <RadioGroup
+            name="workspace_id"
+            value={workspaceId}
+            onValueChange={setWorkspaceId}
+            aria-label={text.workspaceLegend}
+          >
+            {workspaces.map((w) => (
+              <div key={w.id} className="flex min-h-11 items-center gap-3">
+                <RadioGroupItem
+                  id={`mcp-consent-ws-${w.id}`}
+                  value={w.id}
+                  data-testid={`mcp-consent-workspace-${w.id}`}
+                />
+                <Label htmlFor={`mcp-consent-ws-${w.id}`}>
+                  {/* i18n-allow: a separator between two data values */}
+                  {w.name} · {w.organizationName}
+                </Label>
+              </div>
+            ))}
+          </RadioGroup>
+        </div>
+      ) : null}
+      {chosen ? (
+        <div className="flex flex-col gap-3">
+          <Text as="p" variant="body-sm" className="font-semibold">
+            {text.scopesLegend}
+          </Text>
+          {chosen.offered.length === 0 ? (
+            <Text as="p" variant="body-sm" tone="muted">
+              {text.noScopes}
+            </Text>
+          ) : (
+            chosen.offered.map((o) => (
+              <div key={o.scope} className="flex min-h-11 items-center gap-3">
+                <Checkbox
+                  id={`mcp-consent-scope-${o.permission}`}
+                  name="scopes"
+                  value={o.scope}
+                  defaultChecked={false}
+                  data-testid={`mcp-consent-scope-${o.permission}`}
+                />
+                <Label htmlFor={`mcp-consent-scope-${o.permission}`}>{o.label}</Label>
+              </div>
+            ))
+          )}
+          <Text as="p" variant="body-sm" tone="muted" data-testid="mcp-consent-member-reads">
+            {text.memberReads}
+          </Text>
+        </div>
+      ) : null}
+      <div className="flex flex-wrap gap-3">
+        {workspaces.length > 0 ? (
+          <Button
+            type="submit"
+            name="decision"
+            value="allow"
+            size="big"
+            disabled={!chosen}
+            data-testid="mcp-consent-allow"
+          >
+            {text.allow}
+          </Button>
+        ) : null}
+        <Button type="submit" name="decision" value="deny" variant="secondary" size="big" data-testid="mcp-consent-deny">
+          {text.deny}
+        </Button>
+      </div>
+    </form>
+  );
+}

package/templates/apps/web/app/[locale]/(auth)/consent/consent.actions.ts

@@ -0,0 +1,51 @@
+"use server";
+
+/**
+ * `decideConsent` — the consent page's Allow and Deny (#10357 D6).
+ *
+ * Hands the person's choice to AILK's `POST /mcp/consent` in-process
+ * (`auth.api.mcpConsent`), which checks the session, the signed consent
+ * cookie and the role bound on every scope, and answers the client's own
+ * callback URL. Next's Server Action origin check plus that cookie match make
+ * a cross-site submit fail. A refusal returns to the page, which then renders
+ * what is still true.
+ */
+import { localeHref } from "@working-theory/ui";
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+
+import { auth } from "../../../../auth";
+
+const LOCALE_PATTERN = /^[a-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;
+
+export async function decideConsent(formData: FormData): Promise<void> {
+  const field = (name: string): string => {
+    const value = formData.get(name);
+    return typeof value === "string" ? value : "";
+  };
+  const consentCode = field("consent_code");
+  // The fallback redirect is built from it, so only a locale-shaped value
+  // counts: `/evil.example` would make `//evil.example/…`.
+  const locale = LOCALE_PATTERN.test(field("locale")) ? field("locale") : "en";
+  const accept = formData.get("decision") === "allow";
+  const workspaceId = formData.get("workspace_id");
+  const scopes = formData.getAll("scopes").filter((s): s is string => typeof s === "string");
+
+  let redirectURI: string | null;
+  try {
+    const answer = await auth.api.mcpConsent({
+      headers: await headers(),
+      body: {
+        consent_code: consentCode,
+        accept,
+        ...(accept && typeof workspaceId === "string" ? { workspace_id: workspaceId, scopes } : {}),
+      },
+    });
+    redirectURI = answer.redirectURI;
+  } catch {
+    redirectURI = null;
+  }
+  redirect(
+    redirectURI ?? localeHref(locale, `/consent?consent_code=${encodeURIComponent(consentCode)}`),
+  );
+}

package/templates/apps/web/app/[locale]/(auth)/consent/page.tsx

@@ -0,0 +1,144 @@
+/**
+ * `/[locale]/consent` — the MCP consent step (#10357 D6).
+ *
+ * The `mcp` plugin sends every authorization here (AILK's before-hook forces
+ * `prompt=consent`, D2) with a `consent_code` and a signed cookie. The page
+ * reads ONLY `consent_code` from its query — never `client_id` or `scope`,
+ * which the client controls — and asks AILK's `GET /mcp/consent-details`
+ * in-process. That endpoint checks the session, the cookie and that the code
+ * was issued to this person, and answers the client's self-claimed name,
+ * where the code will go, and each workspace with the scopes the person's
+ * role there may approve. Any refusal, or no session, renders the
+ * `unavailable` line and no form.
+ *
+ * It names who is signed in (with a sign-out back to this page), names the
+ * client as the client names itself — an unchecked claim — and its redirect
+ * origin, then hands the workspaces to the `ConsentForm` island. `noindex`,
+ * `referrer: same-origin` (the `account/connect` precedent). Framed by
+ * `AuthShell` like sign-in: `"consent"` is an `AUTH_SEGMENTS` entry.
+ */
+import { localeHref } from "@working-theory/ui";
+import { Button, Heading, Text } from "@working-theory/ui/primitives";
+import { SCOPE_GRANT_MAP, type McpScope } from "@working-theory/validation";
+import type { Metadata } from "next";
+import { headers } from "next/headers";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { auth } from "../../../../auth";
+import { SignOutTrigger } from "../../../../components/sign-out-trigger";
+
+import { ConsentForm, type ConsentWorkspace } from "./consent-form";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  searchParams: Promise<{ consent_code?: string | string[] }>;
+}
+
+interface ConsentDetails {
+  client: { name: string; redirectOrigin: string };
+  workspaces: Array<{ id: string; name: string; organizationName: string; offered: McpScope[] }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "mcpConsent" });
+  return {
+    title: t("metaTitle"),
+    robots: { index: false, follow: false },
+    referrer: "same-origin",
+  };
+}
+
+/** The details and the signed-in email, or `null` on any refusal. */
+async function readDetails(consentCode: string): Promise<{ details: ConsentDetails; email: string } | null> {
+  try {
+    const requestHeaders = await headers();
+    const session = await auth.api.getSession({ headers: requestHeaders });
+    if (!session) return null;
+    const details = (await auth.api.mcpConsentDetails({
+      headers: requestHeaders,
+      query: { consent_code: consentCode },
+    })) as ConsentDetails;
+    return { details, email: session.user.email };
+  } catch {
+    return null;
+  }
+}
+
+export default async function ConsentPage({ params, searchParams }: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  const { consent_code: raw } = await searchParams;
+  const t = await getTranslations({ locale, namespace: "mcpConsent" });
+  const consentCode = typeof raw === "string" ? raw : "";
+  const read = consentCode ? await readDetails(consentCode) : null;
+
+  if (!read) {
+    return (
+      <div className="flex flex-col gap-4" data-testid="mcp-consent-unavailable">
+        <Heading level={1} visual={3}>
+          {t("heading")}
+        </Heading>
+        <Text as="p" variant="body-sm" tone="muted">
+          {t("unavailable")}
+        </Text>
+      </div>
+    );
+  }
+
+  const { details, email } = read;
+  const here = localeHref(locale, `/consent?consent_code=${encodeURIComponent(consentCode)}`);
+  const workspaces: ConsentWorkspace[] = details.workspaces.map((w) => ({
+    id: w.id,
+    name: w.name,
+    organizationName: w.organizationName,
+    offered: w.offered.map((scope) => {
+      const permission = SCOPE_GRANT_MAP[scope];
+      return { scope, permission, label: t(`scopes.${permission}`) };
+    }),
+  }));
+
+  return (
+    <div className="flex flex-col gap-6" data-testid="mcp-consent">
+      <div className="flex flex-col gap-2">
+        <Heading level={1} visual={3}>
+          {t("heading")}
+        </Heading>
+        <Text as="p" variant="body-sm" data-testid="mcp-consent-signed-in">
+          {t("signedInAs", { email })}
+        </Text>
+        <SignOutTrigger homeHref={here}>
+          <Button type="button" variant="link" data-testid="mcp-consent-sign-out">
+            {t("signOut")}
+          </Button>
+        </SignOutTrigger>
+      </div>
+      <div className="flex flex-col gap-2">
+        <Text as="p" variant="body-sm" data-testid="mcp-consent-client">
+          {t("clientClaim", { name: details.client.name })}
+        </Text>
+        <Text as="p" variant="body-sm" tone="muted" data-testid="mcp-consent-redirect-origin">
+          {t("returnsTo", { origin: details.client.redirectOrigin })}
+        </Text>
+      </div>
+      {workspaces.length === 0 ? (
+        <Text as="p" variant="body-sm" tone="muted" data-testid="mcp-consent-no-workspace">
+          {t("noWorkspace")}
+        </Text>
+      ) : null}
+      <ConsentForm
+        consentCode={consentCode}
+        locale={locale}
+        workspaces={workspaces}
+        text={{
+          workspaceLegend: t("workspaceLegend"),
+          scopesLegend: t("scopesLegend"),
+          memberReads: t("memberReads"),
+          noScopes: t("noScopes"),
+          allow: t("allow"),
+          deny: t("deny"),
+        }}
+      />
+    </div>
+  );
+}

package/templates/apps/web/app/[locale]/[slug]/[detail]/__tests__/page.test.tsx

@@ -50,6 +50,33 @@ jest.mock("../../../../../lib/paid-sections.generated", () => {
   };
 });
 
+// #10552 — an MDX body's `## ` lines render through the page's own component
+// map, so a heading's `id` is the real heading adapter's (AC-4).
+jest.mock("next-mdx-remote/rsc", () => {
+  const { createElement, Fragment } = jest.requireActual<typeof import("react")>("react");
+  return {
+    MDXRemote: ({
+      source,
+      components,
+    }: {
+      source: string;
+      components: Record<string, React.ComponentType<{ children?: React.ReactNode }>>;
+    }) =>
+      createElement(
+        Fragment,
+        null,
+        ...source
+          .split("\n")
+          .filter((line) => line.trim() !== "")
+          .map((line, i) =>
+            line.startsWith("## ")
+              ? createElement(components["h2"]!, { key: i }, line.slice(3))
+              : createElement("p", { key: i }, line),
+          ),
+      ),
+  };
+});
+
 jest.mock("@working-theory/ui", () => ({
   // #7789: renderPage's fallback page head renders inside the section Container.
   Container: ({ children }: { children?: React.ReactNode }) =>
@@ -60,10 +87,12 @@ jest.mock("@working-theory/ui", () => ({
   Heading: ({
     children,
     level,
+    id,
   }: {
     children: React.ReactNode;
     level: number;
-  }): React.ReactElement => React.createElement(`h${level}`, null, children),
+    id?: string;
+  }): React.ReactElement => React.createElement(`h${level}`, id ? { id } : null, children),
   SectionRenderer: ({ sections }: { sections: unknown[] }) =>
     React.createElement("div", {
       "data-testid": "section-renderer",
@@ -73,7 +102,8 @@ jest.mock("@working-theory/ui", () => ({
 
 import { notFound } from "next/navigation";
 
-import DetailPage from "../page";
+import { listingExtension } from "../../../../../lib/listings";
+import DetailPage, { generateMetadata } from "../page";
 
 const mockNotFound = notFound as jest.MockedFunction<typeof notFound>;
 
@@ -120,7 +150,7 @@ describe("[slug]/[detail] — the Free /meet/<slug> placeholder route (#6897 D2)
     expect(mockNotFound).not.toHaveBeenCalled();
   });
 
-  it("404s for another hub — the guard fires before getMdxSource is ever called", async () => {
+  it("404s for another hub — no BookCall source is ever read", async () => {
     const getMdxSource = jest.fn().mockResolvedValue(makeSource("book-a-call"));
 
     await expect(
@@ -130,7 +160,9 @@ describe("[slug]/[detail] — the Free /meet/<slug> placeholder route (#6897 D2)
       }),
     ).rejects.toThrow("NEXT_NOT_FOUND");
     expect(mockNotFound).toHaveBeenCalledTimes(1);
-    expect(getMdxSource).not.toHaveBeenCalled();
+    // #10552 — the program-event branch reads the Event source first; the
+    // meet branch's BookCall read never runs for another hub.
+    expect(getMdxSource).not.toHaveBeenCalledWith("BookCall", expect.anything(), expect.anything());
   });
 
   it("404s for an unknown detail slug under the meet hub", async () => {
@@ -248,3 +280,120 @@ describe("[slug]/[detail] — a listicle entry at /<landingPage>/<slug> (#7521)"
     expect(global.fetch).not.toHaveBeenCalled();
   });
 });
+
+// ── #10552 — an Event under a program at /<program>/<event> ─────────────────
+describe("[slug]/[detail] — an Event under a program at /<program>/<event> (#10552)", () => {
+  const landing = (slug: string, title: string) => ({
+    frontmatter: { type: "LandingPage" as const, slug, title, description: `${title}.` },
+    body: "",
+  });
+  const golf = (frontmatter: Record<string, unknown> = { parent: "younglife" }) => ({
+    frontmatter: {
+      type: "Event" as const,
+      slug: "golf-tournament",
+      title: "Golf Tournament 2026",
+      description: "Our annual golf tournament.",
+      publishedAt: "2026-06-12",
+      ...frontmatter,
+    },
+    body: "Tee off with us.\n\n## Sponsorship\n\nBecome a hole sponsor.",
+  });
+  const loader = (
+    pages: Record<string, ReturnType<typeof landing> | ReturnType<typeof golf>>,
+  ) => jest.fn(async (type: string, slug: string) => pages[`${type}/${slug}`] ?? null);
+  const params = (slug: string, detail = "golf-tournament") =>
+    Promise.resolve({ locale: "en", slug, detail });
+
+  let entryAt: jest.SpyInstance;
+  beforeEach(() => {
+    mockNotFound.mockClear();
+    entryAt = jest.spyOn(listingExtension, "entryAt");
+  });
+  afterEach(() => entryAt.mockRestore());
+
+  it("renders the Event with its Event JSON-LD and the program breadcrumb (AC-3)", async () => {
+    const getMdxSource = loader({
+      "LandingPage/younglife": landing("younglife", "Young Life"),
+      "Event/golf-tournament": golf(),
+    });
+
+    const { container } = render(await DetailPage({ params: params("younglife"), getMdxSource }));
+
+    expect(mockNotFound).not.toHaveBeenCalled();
+    const ld = JSON.parse(
+      container.querySelector("script[type='application/ld+json']")?.textContent ?? "{}",
+    ) as Record<string, unknown>;
+    const nodes = (ld["@graph"] ?? [ld]) as Array<Record<string, unknown>>;
+    const event = nodes
+      .map((node) => node["mainEntity"] as Record<string, unknown> | undefined)
+      .find((entity) => entity?.["@type"] === "Event");
+    expect(event).toMatchObject({ name: "Golf Tournament 2026", startDate: "2026-06-12" });
+    const crumbs = nodes.find((node) => node["@type"] === "BreadcrumbList")?.[
+      "itemListElement"
+    ] as Array<Record<string, unknown>>;
+    expect(crumbs[1]).toMatchObject({ name: "Young Life" });
+    expect(crumbs[2]?.["item"]).toMatch(/\/younglife\/golf-tournament$/);
+    expect(entryAt).not.toHaveBeenCalled();
+
+    const metadata = await generateMetadata({ params: params("younglife"), getMdxSource });
+    expect(metadata.title).toBe("Golf Tournament 2026");
+  });
+
+  it("offers add-to-calendar for Google, Outlook and Apple (.ics) at the program URL", async () => {
+    const getMdxSource = loader({
+      "LandingPage/younglife": landing("younglife", "Young Life"),
+      "Event/golf-tournament": golf(),
+    });
+
+    const { container } = render(await DetailPage({ params: params("younglife"), getMdxSource }));
+
+    const href = (id: string) =>
+      container.querySelector(`[data-testid='add-to-calendar-${id}']`)?.getAttribute("href") ?? "";
+    expect(href("google")).toMatch(/^https:\/\/calendar\.google\.com\//);
+    expect(href("outlook")).toMatch(/^https:\/\/outlook\./);
+    expect(href("apple")).toMatch(/^data:text\/calendar/);
+    expect(decodeURIComponent(href("apple"))).toContain("/younglife/golf-tournament");
+  });
+
+  it("supports a #sponsorship anchor from the body heading (AC-4)", async () => {
+    const getMdxSource = loader({
+      "LandingPage/younglife": landing("younglife", "Young Life"),
+      "Event/golf-tournament": golf(),
+    });
+
+    const { container } = render(await DetailPage({ params: params("younglife"), getMdxSource }));
+
+    const anchors = container.querySelectorAll("#sponsorship");
+    expect(anchors).toHaveLength(1);
+    expect(anchors[0]?.tagName).toBe("H2");
+    expect(anchors[0]?.textContent).toBe("Sponsorship");
+  });
+
+  it("serves it only under the program it names (AC-5)", async () => {
+    const cases: Array<[string, ReturnType<typeof loader>]> = [
+      [
+        "other",
+        loader({
+          "LandingPage/other": landing("other", "Other"),
+          "LandingPage/younglife": landing("younglife", "Young Life"),
+          "Event/golf-tournament": golf(),
+        }),
+      ],
+      ["younglife", loader({ "Event/golf-tournament": golf() })],
+      [
+        "younglife",
+        loader({
+          "LandingPage/younglife": landing("younglife", "Young Life"),
+          "Event/golf-tournament": golf({}),
+        }),
+      ],
+    ];
+    for (const [slug, getMdxSource] of cases) {
+      mockNotFound.mockClear();
+      await expect(DetailPage({ params: params(slug), getMdxSource })).rejects.toThrow(
+        "NEXT_NOT_FOUND",
+      );
+      expect(mockNotFound).toHaveBeenCalledTimes(1);
+    }
+  });
+});

package/templates/apps/web/app/[locale]/[slug]/[detail]/page.tsx

@@ -1,5 +1,6 @@
 // Two-segment URLs: the Free /meet/<slug> placeholder detail pages (#6897
-// D2), and a listicle directory's entry pages (#7521).
+// D2), an Event under a program (#10552), and a listicle directory's entry
+// pages (#7521).
 //
 // The meet hub: BookCall content served at /meet/<detail> by Next.js
 // static-segment precedence: wherever apps/web/app/[locale]/meet/ exists (the
@@ -10,6 +11,13 @@
 // 404s rather than rendering an empty-state placeholder — the same contract
 // `[slug]/page.tsx` documents).
 //
+// A program's event: `/<program>/<event>` serves the Event MDX `<event>` when
+// its frontmatter `parent` is `<program>` and `/<program>` is a LandingPage —
+// before the listing extension, so an event URL costs no listing read. Any
+// other combination falls through. A `parent` that names a static top-level
+// route directory (`events`, `services`, …) or `meet` is unreachable here:
+// Next.js serves the static directory first (spec 10552 § 5.3).
+//
 // Every other hub: `/<landingPage>/<entry>` for a listicle whose landing page
 // is a generic one-segment page (`/tools` → `[slug]/page.tsx`). The listing
 // extension (`lib/listings.tsx`) renders the accepted entry, or the route
@@ -49,6 +57,18 @@ function hubPage(
     (await getMdxSource("BlogList", slug, locale)) !== null;
 }
 
+/** The Event `detail` when it names `slug` as its program and `/<slug>` is a LandingPage. */
+async function programEvent(
+  slug: string,
+  detail: string,
+  locale: string,
+  getMdxSource: typeof defaultGetMdxSource = loadMdxSource,
+): Promise<Awaited<ReturnType<typeof defaultGetMdxSource>>> {
+  const source = await getMdxSource("Event", detail, locale);
+  if (source === null || source.frontmatter.parent !== slug) return null;
+  return (await getMdxSource("LandingPage", slug, locale)) === null ? null : source;
+}
+
 interface Props {
   params: Promise<{ locale: string; slug: string; detail: string }>;
   /** Test-only DI override for getMdxSource. Production callers leave undefined. */
@@ -57,12 +77,21 @@ interface Props {
 
 export async function generateMetadata({
   params,
-}: Pick<Props, "params">): Promise<Metadata> {
+  getMdxSource,
+}: Pick<Props, "params" | "getMdxSource">): Promise<Metadata> {
   const { locale, slug, detail } = await params;
   // Mirrors renderPageMetadata's own missing-frontmatter → {} contract: a
   // hub with no listing entry is the same "nothing to title" case, not a
   // thrown 404 — generateMetadata cannot itself change the response status.
   if (slug !== MEET_PLACEHOLDER_HUB) {
+    if ((await programEvent(slug, detail, locale, getMdxSource)) !== null) {
+      return renderPageMetadata({
+        type: "Event",
+        slug: detail,
+        locale,
+        ...(getMdxSource !== undefined && { getMdxSource }),
+      });
+    }
     return (
       (await listingExtension.entryMetadataAt(
         `/${slug}/${detail}`,
@@ -81,6 +110,20 @@ export default async function Page({
 }: Props): Promise<ReactElement> {
   const { locale, slug, detail } = await params;
   if (slug !== MEET_PLACEHOLDER_HUB) {
+    const event = await programEvent(slug, detail, locale, getMdxSource);
+    if (event !== null) {
+      // A composed Event renders its sections; a prose one its MDX body — the
+      // rule events/[slug]/page.tsx applies.
+      const sections = (event.frontmatter as { sections?: unknown[] }).sections;
+      const composed = Array.isArray(sections) && sections.length > 0;
+      return renderPage({
+        type: "Event",
+        slug: detail,
+        locale,
+        ...(composed ? {} : { bodyMode: "mdx-body" as const }),
+        ...(getMdxSource !== undefined && { getMdxSource }),
+      });
+    }
     const entry = await listingExtension.entryAt(
       `/${slug}/${detail}`,
       detail,

package/templates/apps/web/app/[locale]/about/__tests__/about-routes.test.tsx

@@ -329,7 +329,7 @@ describe("the sitemap and llms.txt advertise /about/<slug>, never a bare /<slug>
 
   it("sitemap.xml: one <loc> ending in /about/sam-henry, none ending in a bare /sam-henry", async () => {
     const stubAdapter = makeStubAdapter();
-    const GET = createSitemapHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [] });
+    const GET = createSitemapHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [], discoverable: async () => true });
     const response = await GET();
     const text = await response.text();
     const locs = Array.from(text.matchAll(/<loc>([^<]*)<\/loc>/g)).map(
@@ -341,7 +341,7 @@ describe("the sitemap and llms.txt advertise /about/<slug>, never a bare /<slug>
 
   it("llms.txt: names a URL ending in /about/sam-henry", async () => {
     const stubAdapter = makeStubAdapter();
-    const GET = createLlmsHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [] });
+    const GET = createLlmsHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [], discoverable: async () => true });
     const response = await GET();
     const text = await response.text();
     expect(text).toContain("URL: https://site.example/about/sam-henry");

package/templates/apps/web/app/[locale]/contact/__tests__/site-contact-lines.test.ts

@@ -161,3 +161,52 @@ describe("readSiteContactLines (#7742 D4)", () => {
     expect(readSiteContactLines()).toEqual([]);
   });
 });
+
+describe("readSiteContactLines(locality) — the site's own locality line (#10550 D2)", () => {
+  function writePerson(): void {
+    writeSite(
+      [
+        "siteName: Wendi Henry",
+        "contactEmail: a@b.test",
+        "siteIdentity:",
+        "  kind: Person",
+        "  name: Wendi Henry",
+        "  url: https://wendi.test",
+        ...addressYaml("  ", "Denver", "CO"),
+      ].join("\n"),
+    );
+  }
+
+  it("a set locality wins over the address line, above the email", () => {
+    writePerson();
+    expect(readSiteContactLines("Colorado Springs, CO")).toEqual([
+      { label: "Colorado Springs, CO" },
+      { label: "a@b.test", href: "mailto:a@b.test" },
+    ]);
+  });
+
+  it.each([[undefined], ["  "]])("locality %p keeps the address line", (locality) => {
+    writePerson();
+    expect(readSiteContactLines(locality)).toEqual([
+      { label: "Denver, CO" },
+      { label: "a@b.test", href: "mailto:a@b.test" },
+    ]);
+  });
+
+  it("an Organization takes the set locality, then the email", () => {
+    writeSite(
+      [
+        "siteName: Acme",
+        "contactEmail: a@b.test",
+        "siteIdentity:",
+        "  kind: Organization",
+        "  name: Acme",
+        "  url: https://acme.test",
+      ].join("\n"),
+    );
+    expect(readSiteContactLines("Colorado Springs, CO")).toEqual([
+      { label: "Colorado Springs, CO" },
+      { label: "a@b.test", href: "mailto:a@b.test" },
+    ]);
+  });
+});