create-ailk 0.3.0 → 0.5.0

package/templates/apps/web/app/[locale]/layout.tsx

@@ -25,8 +25,10 @@ import "../globals.css";
 import { Telemetry, VerificationMeta } from "@working-theory/analytics";
 import { MarketingShell } from "@working-theory/templates/shells";
 import { themeToCssVarsBothModes } from "@working-theory/theme";
-import { isRtl } from "@working-theory/ui";
+import { Link, isRtl, localeHref } from "@working-theory/ui";
+import { LocaleSwitcherNav } from "@working-theory/ui/blocks";
 import {
+  Banner,
   Footer,
   Nav,
   type NavAction,
@@ -49,6 +51,7 @@ import { SignOutTrigger } from "../../components/sign-out-trigger";
 import { navItems } from "../../lib/nav-config";
 import { getOgImageUrl } from "../../lib/og";
 import { SITE_NAME, siteLogo } from "../../lib/site-brand";
+import { siteChrome } from "../../lib/site-chrome";
 import { loadSiteBrandTokens } from "../../lib/site-theme";
 import { resolveBaseUrl } from "../../src/lib/routes";
 
@@ -57,6 +60,12 @@ import { resolveBaseUrl } from "../../src/lib/routes";
 const DEFAULT_LOCALE = "en";
 const THEME_COOKIE_NAME =
   process.env.NEXT_PUBLIC_THEME_COOKIE_NAME ?? "ailk-theme";
+/**
+ * The cookie the consent island persists the visitor's choice under (#5557).
+ * Passed to Banner explicitly so the server-side read below and the island's
+ * client-side write name the same cookie by construction.
+ */
+const CONSENT_COOKIE_NAME = "ailk-consent";
 
 type ThemeMode = "light" | "dark";
 
@@ -73,7 +82,9 @@ type ThemeMode = "light" | "dark";
  * has to satisfy the type: one minimal fields-step and a dead `action`.
  */
 const NAV_CLIENT_ACTION_FLOW: NavActionFlow["flow"] = {
-  steps: [{ id: "noop", fields: [{ name: "noop", label: "noop", type: "text" }] }],
+  steps: [
+    { id: "noop", fields: [{ name: "noop", label: "noop", type: "text" }] },
+  ],
   action: "#",
 };
 
@@ -100,6 +111,26 @@ async function resolveThemeMode(): Promise<ThemeMode> {
   }
 }
 
+/**
+ * Whether this visitor has already accepted or declined cookies (#5557).
+ *
+ * Read on the server, not left to the island alone: `BannerConsentIsland`
+ * initialises its `consented` state from `document.cookie`, which makes the
+ * CLIENT render null while the SERVER (no `document`) has already streamed
+ * the banner — React then leaves that server markup in place, un-hydrated, so
+ * a returning visitor sees a dead banner whose buttons do nothing. Deciding
+ * here means a decided visitor gets no banner markup at all, and a fresh one
+ * gets the live island that hides itself on Accept / Reject.
+ */
+async function hasConsentChoice(): Promise<boolean> {
+  try {
+    const cookieStore = await cookies();
+    return cookieStore.get(CONSENT_COOKIE_NAME)?.value !== undefined;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Blocking inline script that runs synchronously before any styled element.
  *
@@ -177,6 +208,7 @@ export default async function LocaleLayout({
   const { locale } = await params;
   const messages = await getMessages();
   const themeMode = await resolveThemeMode();
+  const consentDecided = await hasConsentChoice();
   // Server-side session read (#4984) — the same `auth.api.getSession` idiom
   // the `(authed)` segment guard uses. Null when signed out or auth is unset.
   const session = await auth.api.getSession({ headers: await headers() });
@@ -187,12 +219,26 @@ export default async function LocaleLayout({
   const navLabels = {
     items: {
       home: tNav("home"),
+      // The Free marketing-site chrome (#5469 D5): the Product flyout's three
+      // entries + descriptions, the top-level items, and the Get started CTA.
+      product: tNav("product"),
+      howItWorks: tNav("howItWorks"),
+      howItWorksDesc: tNav("howItWorksDesc"),
+      features: tNav("features"),
+      featuresDesc: tNav("featuresDesc"),
+      faq: tNav("faq"),
+      faqDesc: tNav("faqDesc"),
+      pricing: tNav("pricing"),
+      about: tNav("about"),
+      getStarted: tNav("getStarted"),
       docs: tNav("docs"),
       blog: tNav("blog"),
-      // The scheduling module's booking page (#4633). Present in the map
-      // unconditionally, like `docs` and `blog`: the map is a label lookup, and
-      // an entry for a surface this site did not scaffold is never reached —
-      // `nav-config.ts` only lists surfaces the declared architecture carries.
+      // The scheduling module's booking page, /meet (#4633; renamed from the
+      // schedule/ route by #5563 — the label key itself keeps its name, D1
+      // R2: it names copy, not a route). Present in the map unconditionally,
+      // like `docs` and `blog`: the map is a label lookup, and an entry for
+      // a surface this site did not scaffold is never reached — `nav-config.ts`
+      // only lists surfaces the declared architecture carries.
       schedule: tNav("schedule"),
       // Session-aware action labels (#4984). `account` carries the signed-in
       // user's display name (name, else email) so the Nav shows WHO is signed
@@ -207,8 +253,13 @@ export default async function LocaleLayout({
     closeMenu: tNav("closeMenu"),
   };
   const navOverflowLabel = tNav("moreLinks");
+  // Cookie-consent copy (#5557). The `consent` namespace ships in every
+  // scaffold's messages file; the Banner below is UI-only — OSS ships no
+  // enforcement, the callbacks are the hook for @working-theory/consent.
+  const tConsent = await getTranslations({ locale, namespace: "consent" });
 
-  // Right-side action cluster (#4984). Signed out → a single outline-strong
+  // Right-side action cluster (#4984). Signed out → the Free template's pair
+  // (#5469 D5): a primary "Get started" → /contact beside the outline-strong
   // "Sign in" link (the operator's auth-pair idiom, #4370, MINUS Sign up —
   // this site offers no sign-up flow). Signed in → the user's name (a
   // non-navigating label) + an outline-strong "Sign out"; both authored as
@@ -224,7 +275,10 @@ export default async function LocaleLayout({
           variant: "outline-strong",
         },
       ]
-    : [{ labelKey: "signIn", path: "/sign-in", variant: "outline-strong" }];
+    : [
+        { labelKey: "getStarted", path: "/contact", variant: "primary" },
+        { labelKey: "signIn", path: "/sign-in", variant: "outline-strong" },
+      ];
 
   // Only compose the flow seam when there is a flow action to compose. This
   // layout is a Server Component and `renderFlowTrigger` is a function, so
@@ -237,8 +291,64 @@ export default async function LocaleLayout({
   // this is the caller half of that contract.
   const hasFlowAction = navActions.some((action) => action.kind === "flow");
 
-  // Shared brand mark injected into both Nav and Footer chrome slots.
+  // Shared brand mark injected into both Nav and Footer chrome slots. The
+  // mark comes from site-brand.tsx (the light/dark pair the /sign-in card
+  // also renders); the Nav adds the shipped wordmark beside it so BrandLogo
+  // composes mark + wordmark on desktop and mark-only below `md` (#5469 D5).
   const brandLogo = siteLogo();
+  const brandWordmark = {
+    src: "/wordmark.svg",
+    alt: SITE_NAME,
+    width: 140,
+    height: 16,
+  };
+
+  // The locales the footer's language switcher offers — the same list the
+  // middleware and hreflang alternates read (NEXT_PUBLIC_ENABLED_LOCALES).
+  const enabledLocales = readLocales();
+
+  // The announcement bar is HOME-ONLY (#5469 D5): its route gate matches the
+  // pathname literally, and under next-intl's `as-needed` prefixing the home
+  // path is `/` for the default locale and `/<locale>` for every other one.
+  const homePath = locale === DEFAULT_LOCALE ? "/" : `/${locale}`;
+
+  // Deck home (#5612 D3): `siteChrome.home === "deck"` only ever applies
+  // `snap="mandatory"` + `deckHero` on the locale-root route — every other
+  // path renders byte-identically regardless of the knob. `x-pathname` is the
+  // same header `generateMetadata` above reads (forwarded by middleware.ts);
+  // Next.js's `headers()` is request-scoped and cheap to call again here.
+  const pathname = (await headers()).get("x-pathname") ?? homePath;
+  const isDeckHome = siteChrome.home === "deck" && pathname === homePath;
+
+  // Placeholder social handles + copyright (#5469 D5): `{{COMPANY_HANDLE}}` /
+  // `{{COMPANY_NAME}}` are create-ailk markers substituted at scaffold time
+  // (packages/create-ailk/src/programmatic.ts), so a customer's site never
+  // carries the kit vendor's own identity here. The year is computed, never
+  // typed, so the placeholder does not go stale.
+  const socialLinks = [
+    { platform: "facebook", href: "https://facebook.com/{{COMPANY_HANDLE}}" },
+    { platform: "instagram", href: "https://instagram.com/{{COMPANY_HANDLE}}" },
+    { platform: "x", href: "https://x.com/{{COMPANY_HANDLE}}" },
+    {
+      platform: "linkedin",
+      href: "https://linkedin.com/company/{{COMPANY_HANDLE}}",
+    },
+    { platform: "youtube", href: "https://youtube.com/@{{COMPANY_HANDLE}}" },
+  ] as const;
+  const copyrightText = `© ${new Date().getFullYear()} {{COMPANY_NAME}}`;
+
+  // Footer legal links (#5612 D3). The centered variant folds in FAQ — the
+  // roster's third always-scaffolded core route (`/faq`, alongside `/privacy`
+  // and `/terms`) — since a mark-only nav (its usual pairing, #5589) has
+  // nowhere else on the page linking it. The default `columns` footer keeps
+  // exactly today's two-entry list, byte-identical.
+  const legalLinks = [
+    { label: "Privacy Policy", href: "/privacy" },
+    { label: "Terms of Service", href: "/terms" },
+    ...(siteChrome.footer === "centered"
+      ? [{ label: navLabels.items.faq, href: "/faq" }]
+      : []),
+  ];
 
   // The site's own declared colours, read from `content/_site.mdx`'s `theme:`
   // block and translated from that customer-facing vocabulary onto a token
@@ -257,7 +367,11 @@ export default async function LocaleLayout({
   );
 
   return (
-    <html lang={locale} dir={isRtl(locale) ? "rtl" : "ltr"} data-theme={themeMode}>
+    <html
+      lang={locale}
+      dir={isRtl(locale) ? "rtl" : "ltr"}
+      data-theme={themeMode}
+    >
       <head>
         {/* Flash-prevention: runs synchronously before any styled element */}
         <script
@@ -271,10 +385,24 @@ export default async function LocaleLayout({
         />
         {/* Favicons — single brand mark (theme-independent), PNG fallbacks, ICO legacy */}
         <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
-        <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
-        <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
+        <link
+          rel="icon"
+          type="image/png"
+          sizes="32x32"
+          href="/favicon-32x32.png"
+        />
+        <link
+          rel="icon"
+          type="image/png"
+          sizes="16x16"
+          href="/favicon-16x16.png"
+        />
         <link rel="shortcut icon" href="/favicon.ico" />
-        <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+        <link
+          rel="apple-touch-icon"
+          sizes="180x180"
+          href="/apple-touch-icon.png"
+        />
         <link rel="manifest" href="/site.webmanifest" />
         <GoogleAnalytics />
         <VerificationMeta />
@@ -294,13 +422,35 @@ export default async function LocaleLayout({
            */}
           <MarketingShell
             contentOwnsMain
+            gutters="plain"
+            bannerPlacement="above-nav"
+            {...(siteChrome.announcementBanner
+              ? {
+                  banner: (
+                    <Banner
+                      variant="contrast"
+                      placement="above-nav"
+                      message="Medium length banner heading with link goes here"
+                      action={{ label: "Link", href: "/pricing", kind: "link" }}
+                      routes={{ include: [homePath] }}
+                      dismissible={false}
+                      locale={locale}
+                    />
+                  ),
+                }
+              : {})}
+            {...(isDeckHome
+              ? { snap: "mandatory" as const, deckHero: true }
+              : {})}
             nav={
               <Nav
                 locale={locale}
                 labels={navLabels}
-                navItems={navItems}
+                navItems={siteChrome.nav === "mark-only" ? [] : navItems}
                 siteName={SITE_NAME}
+                showThemeToggle={false}
                 logo={brandLogo}
+                wordmark={brandWordmark}
                 overflowLabel={navOverflowLabel}
                 actions={navActions}
                 {...(hasFlowAction
@@ -327,8 +477,22 @@ export default async function LocaleLayout({
                 navItems={navItems}
                 siteName={SITE_NAME}
                 logo={brandLogo}
-                // #4157 — deliberately left as a literal "Built with AI Launch
-                // Kit" / https://ailaunchkit.ai, not SITE_NAME: this credits
+                social={[...socialLinks]}
+                {...(siteChrome.footer === "centered"
+                  ? { layout: "centered" as const }
+                  : {})}
+                showThemeToggle
+                copyrightText={copyrightText}
+                legalLinks={legalLinks}
+                languageSwitcher={
+                  <LocaleSwitcherNav
+                    current={locale}
+                    locales={enabledLocales}
+                    pathname={pathname}
+                  />
+                }
+                // #4157 — deliberately left as a literal "Built by Working
+                // Theory Labs" / https://ailaunchkit.ai, not SITE_NAME: this credits
                 // the OSS TEMPLATE this site is built with (a "powered by"
                 // link, unconditional in OSS forks per the comment above),
                 // never the customer's own identity, so it isn't the vendor-
@@ -336,7 +500,7 @@ export default async function LocaleLayout({
                 // docs/specs/4157-scaffold-brand-defaults-spec.md § Design
                 // Decisions for the fuller reasoning.
                 attribution={{
-                  label: "Built with AI Launch Kit",
+                  label: "Built by Working Theory Labs",
                   href: "https://ailaunchkit.ai",
                 }}
               />
@@ -344,6 +508,39 @@ export default async function LocaleLayout({
           >
             {children}
           </MarketingShell>
+          {/*
+           * Cookie consent (#5557). Bottom-pinned `info` Banner in consent
+           * mode: `secondaryAction` makes Banner compose BannerConsentIsland,
+           * which reads/writes the `ailk-consent` cookie itself — a fresh
+           * visitor sees it, an accepted/declined one does not, on every
+           * page. Out of the shell's flow (placement `bottom` is a fixed
+           * overlay), so accepting causes no layout shift.
+           */}
+          {consentDecided ? null : (
+            <Banner
+              variant="info"
+              placement="bottom"
+              consentCookieName={CONSENT_COOKIE_NAME}
+              title={tConsent("title")}
+              message={
+                <>
+                  {tConsent("body")}{" "}
+                  <Link
+                    href={localeHref(locale, "/privacy")}
+                    variant="unstyled"
+                    className="font-semibold text-current underline underline-offset-4"
+                  >
+                    {tConsent("policyLinkLabel")}
+                  </Link>
+                </>
+              }
+              dismissible={false}
+              acceptLabel={tConsent("acceptLabel")}
+              secondaryAction={{ label: tConsent("rejectLabel") }}
+              rejectLabel={tConsent("rejectLabel")}
+              locale={locale}
+            />
+          )}
           <Telemetry />
         </NextIntlClientProvider>
       </body>

package/templates/apps/web/app/[locale]/pricing/page.tsx

@@ -0,0 +1,40 @@
+// Pricing page. Reads the Pricing MDX frontmatter, renders sections via
+// SectionRenderer, and emits a JSON-LD <script>.
+import type {
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections} from "@working-theory/page-renderer";
+import {
+  renderPage,
+  renderPageMetadata
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+}
+
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "Pricing", slug: "pricing", locale });
+}
+
+export default async function Page({
+  params,
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  return renderPage({
+    type: "Pricing",
+    slug: "pricing",
+    locale,
+    translationsNamespace: "pricing",
+    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(getPageSections !== undefined && { getPageSections }),
+  });
+}

package/templates/apps/web/app/[locale]/privacy/page.tsx

@@ -0,0 +1,40 @@
+// Privacy page. Reads the PrivacyPage MDX frontmatter, renders sections via
+// SectionRenderer, and emits a JSON-LD <script>.
+import type {
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections} from "@working-theory/page-renderer";
+import {
+  renderPage,
+  renderPageMetadata
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+}
+
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "PrivacyPage", slug: "privacy", locale });
+}
+
+export default async function Page({
+  params,
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  return renderPage({
+    type: "PrivacyPage",
+    slug: "privacy",
+    locale,
+    translationsNamespace: "privacy",
+    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(getPageSections !== undefined && { getPageSections }),
+  });
+}

package/templates/apps/web/app/[locale]/terms/page.tsx

@@ -0,0 +1,40 @@
+// Terms page. Reads the TermsPage MDX frontmatter, renders sections via
+// SectionRenderer, and emits a JSON-LD <script>.
+import type {
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections} from "@working-theory/page-renderer";
+import {
+  renderPage,
+  renderPageMetadata
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+}
+
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "TermsPage", slug: "terms", locale });
+}
+
+export default async function Page({
+  params,
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  return renderPage({
+    type: "TermsPage",
+    slug: "terms",
+    locale,
+    translationsNamespace: "terms",
+    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(getPageSections !== undefined && { getPageSections }),
+  });
+}

package/templates/apps/web/components/google-analytics.tsx

@@ -12,11 +12,19 @@
 import Script from "next/script";
 import type { ReactElement } from "react";
 
+import { TOKEN_QUERY_PARAMS } from "../lib/telemetry-scrub";
+
 export function GoogleAnalytics(): ReactElement | null {
   const tagId = process.env.NEXT_PUBLIC_GOOGLE_TAG_ID;
   if (!tagId) {
     return null;
   }
+  // The init script below runs in the browser as raw inline JS, outside any
+  // module graph, so it can't `import` telemetry-scrub.ts — it gets its own
+  // copy of scrubTelemetryUrl, driven by the shared param list, so the
+  // report-grant token (?g=<id>, #5562) never reaches GA's page_location
+  // default (document.location.href) (#5613).
+  const scrubParamsJson = JSON.stringify(TOKEN_QUERY_PARAMS);
   return (
     <>
       <Script
@@ -27,7 +35,16 @@ export function GoogleAnalytics(): ReactElement | null {
         {`window.dataLayer = window.dataLayer || [];
 function gtag(){dataLayer.push(arguments);}
 gtag('js', new Date());
-gtag('config', '${tagId}');`}
+function scrubTelemetryUrl(url) {
+  try {
+    var parsed = new URL(url);
+    ${scrubParamsJson}.forEach(function (param) { parsed.searchParams.delete(param); });
+    return parsed.toString();
+  } catch (e) {
+    return url;
+  }
+}
+gtag('config', '${tagId}', { page_location: scrubTelemetryUrl(window.location.href) });`}
       </Script>
     </>
   );

package/templates/apps/web/eslint.config.mjs

@@ -0,0 +1,69 @@
+// Self-contained ESLint flat config for this scaffolded package.
+//
+// It deliberately does NOT depend on @working-theory/eslint-config — that
+// package is internal to the AI Launch Kit monorepo and is not published, so
+// it cannot be a dependency of a scaffolded starter. Everything below comes
+// from public npm packages already pinned as devDependencies (see
+// package.json): @eslint/js, globals and typescript-eslint.
+//
+// Source file name (#5556): this file is checked in as `_eslint.config.mjs`,
+// not `eslint.config.mjs` — build-templates.mjs renames it at snapshot time
+// (renameScaffoldLintConfigs()). A file literally named `eslint.config.mjs`
+// anywhere under this monorepo (even one this repo's own root eslint.config.ts
+// lists in its `ignores`) is auto-discovered by ESLint's flat-config nested
+// resolution as a competing config root, which breaks the monorepo's own
+// lint runs (verified live: typescript-eslint's "multiple candidate
+// TSConfigRootDirs" parser error across unrelated packages/create-ailk
+// files). The underscore prefix keeps it invisible to that discovery while
+// it lives in this checkout; only the snapshot in templates/ — which ships
+// to the customer, not this repo — gets the real filename.
+import js from "@eslint/js";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  {
+    ignores: [
+      "**/.next/**",
+      "**/dist/**",
+      "**/generated/**",
+      "**/node_modules/**",
+    ],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    languageOptions: {
+      globals: {
+        ...globals.node,
+        ...globals.browser,
+        ...globals.jest,
+      },
+      // Explicit, self-contained root — this scaffold config is never meant
+      // to combine with any sibling scaffold package's config (each ships
+      // standalone), and leaving it unset makes typescript-eslint's
+      // candidate-root disambiguation ambiguous the moment more than one
+      // scaffold package's config resolves in the same ESLint process (e.g.
+      // this monorepo's own `templates/` build, where all four exist
+      // side by side; a real customer scaffold never has that problem,
+      // since it only ever ships and lints ONE of these four at a time).
+      parserOptions: {
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+    rules: {
+      // Downgraded rather than off, so both stay visible without failing a
+      // fresh scaffold's lint:
+      //   - unused-vars: most of the source follows the underscore-prefix
+      //     convention for intentionally-unused bindings, which this rule's
+      //     default options don't recognize; a handful of test fixtures also
+      //     carry genuinely-unused locals this minimal config doesn't try to
+      //     triage file-by-file.
+      //   - require-imports: CommonJS require() is the correct form in Jest
+      //     config/mock files and in a few test-only dynamic re-require
+      //     patterns.
+      "@typescript-eslint/no-unused-vars": "warn",
+      "@typescript-eslint/no-require-imports": "warn",
+    },
+  },
+);

package/templates/apps/web/jest.config.cjs

@@ -58,9 +58,15 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/schema-validator/dist/index.js",
     "^@working-theory/sections-registry$":
       "<rootDir>/node_modules/@working-theory/sections-registry/dist/index.js",
-
     "^@working-theory/templates/shells$":
       "<rootDir>/node_modules/@working-theory/templates/dist/shells/index.js",
+    // Pure-data routes-map subpath (#5572 U2) — mapped directly to source so
+    // a consumer of the lightweight `./routes` export (routes.ts,
+    // next.config.mjs, this suite) never pulls in the templates package's
+    // shells (React/lucide-react) chain, mirroring the same entry in the
+    // root and create-ailk jest configs.
+    "^@working-theory/templates/routes$":
+      "<rootDir>/node_modules/@working-theory/templates/dist/routes-map.js",
     "^@working-theory/templates$": "<rootDir>/node_modules/@working-theory/templates/dist/index.js",
     "^@working-theory/ui$": "<rootDir>/node_modules/@working-theory/ui/dist/index.js",
     "^@working-theory/ui/blocks$": "<rootDir>/node_modules/@working-theory/ui/dist/blocks/index.js",
@@ -69,20 +75,6 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/ui/dist/primitives/index.js",
     "^@working-theory/ui/panels$": "<rootDir>/node_modules/@working-theory/ui/dist/panels/index.js",
     "^@working-theory/ui/sections$": "<rootDir>/node_modules/@working-theory/ui/dist/sections/index.js",
-    // #5214: the scheduling slice's renderer-registration subpath. Mapped to
-    // source like every sibling above — packages/ui/dist isn't built in this
-    // workspace pre-`pnpm build`. The target strips with the slice on the public
-    // tree, where nothing imports it, so the unused mapping is inert there.
-    "^@working-theory/ui/slices/scheduling$":
-      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/scheduling.js",
-    // #5366: the signal-collectors slice's re-export subpath. Same reasoning
-    // as the scheduling mapping above.
-    "^@working-theory/ui/slices/signal-collectors$":
-      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/signal-collectors.js",
-    // #5364: the commerce slice's renderer-registration + CheckoutPriceCard
-    // re-export subpath. Same reasoning as the scheduling mapping above.
-    "^@working-theory/ui/slices/commerce$":
-      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/commerce.js",
     "^@working-theory/theme$": "<rootDir>/node_modules/@working-theory/theme/dist/index.js",
     // site-config publishes ESM in dist/; map to source so ts-jest compiles it
     // through the same transformer as every sibling above. Only the
@@ -92,6 +84,11 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/site-config/dist/schema/index.js",
     "^@working-theory/validation$": "<rootDir>/node_modules/@working-theory/validation/dist/index.js",
     "^@working-theory/web-i18n$": "<rootDir>/node_modules/@working-theory/web-i18n/dist/index.js",
+    // The dependency-free tenancy-constants subpath (database/tenancy.ts —
+    // it imports only a type from @working-theory/ids). Mapped to source like
+    // every sibling above; `database/dist` is not built in this workspace
+    // pre-`pnpm build`.
+    "^@working-theory/database/tenancy$": "<rootDir>/node_modules/@working-theory/database/dist/tenancy.js",
     // #5025: pnpm keys next-intl's virtual-store path on its resolved peers,
     // so apps/web and packages/page-renderer can link two PHYSICALLY DISTINCT
     // copies of the same version — and a `jest.mock("next-intl/server")` in