create-ailk 0.4.0 → 0.5.0

package/templates/apps/web/app/[locale]/layout.tsx

@@ -25,8 +25,10 @@ import "../globals.css";
 import { Telemetry, VerificationMeta } from "@working-theory/analytics";
 import { MarketingShell } from "@working-theory/templates/shells";
 import { themeToCssVarsBothModes } from "@working-theory/theme";
-import { isRtl } from "@working-theory/ui";
+import { Link, isRtl, localeHref } from "@working-theory/ui";
+import { LocaleSwitcherNav } from "@working-theory/ui/blocks";
 import {
+  Banner,
   Footer,
   Nav,
   type NavAction,
@@ -49,6 +51,7 @@ import { SignOutTrigger } from "../../components/sign-out-trigger";
 import { navItems } from "../../lib/nav-config";
 import { getOgImageUrl } from "../../lib/og";
 import { SITE_NAME, siteLogo } from "../../lib/site-brand";
+import { siteChrome } from "../../lib/site-chrome";
 import { loadSiteBrandTokens } from "../../lib/site-theme";
 import { resolveBaseUrl } from "../../src/lib/routes";
 
@@ -57,6 +60,12 @@ import { resolveBaseUrl } from "../../src/lib/routes";
 const DEFAULT_LOCALE = "en";
 const THEME_COOKIE_NAME =
   process.env.NEXT_PUBLIC_THEME_COOKIE_NAME ?? "ailk-theme";
+/**
+ * The cookie the consent island persists the visitor's choice under (#5557).
+ * Passed to Banner explicitly so the server-side read below and the island's
+ * client-side write name the same cookie by construction.
+ */
+const CONSENT_COOKIE_NAME = "ailk-consent";
 
 type ThemeMode = "light" | "dark";
 
@@ -73,7 +82,9 @@ type ThemeMode = "light" | "dark";
  * has to satisfy the type: one minimal fields-step and a dead `action`.
  */
 const NAV_CLIENT_ACTION_FLOW: NavActionFlow["flow"] = {
-  steps: [{ id: "noop", fields: [{ name: "noop", label: "noop", type: "text" }] }],
+  steps: [
+    { id: "noop", fields: [{ name: "noop", label: "noop", type: "text" }] },
+  ],
   action: "#",
 };
 
@@ -100,6 +111,26 @@ async function resolveThemeMode(): Promise<ThemeMode> {
   }
 }
 
+/**
+ * Whether this visitor has already accepted or declined cookies (#5557).
+ *
+ * Read on the server, not left to the island alone: `BannerConsentIsland`
+ * initialises its `consented` state from `document.cookie`, which makes the
+ * CLIENT render null while the SERVER (no `document`) has already streamed
+ * the banner — React then leaves that server markup in place, un-hydrated, so
+ * a returning visitor sees a dead banner whose buttons do nothing. Deciding
+ * here means a decided visitor gets no banner markup at all, and a fresh one
+ * gets the live island that hides itself on Accept / Reject.
+ */
+async function hasConsentChoice(): Promise<boolean> {
+  try {
+    const cookieStore = await cookies();
+    return cookieStore.get(CONSENT_COOKIE_NAME)?.value !== undefined;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Blocking inline script that runs synchronously before any styled element.
  *
@@ -177,6 +208,7 @@ export default async function LocaleLayout({
   const { locale } = await params;
   const messages = await getMessages();
   const themeMode = await resolveThemeMode();
+  const consentDecided = await hasConsentChoice();
   // Server-side session read (#4984) — the same `auth.api.getSession` idiom
   // the `(authed)` segment guard uses. Null when signed out or auth is unset.
   const session = await auth.api.getSession({ headers: await headers() });
@@ -187,12 +219,26 @@ export default async function LocaleLayout({
   const navLabels = {
     items: {
       home: tNav("home"),
+      // The Free marketing-site chrome (#5469 D5): the Product flyout's three
+      // entries + descriptions, the top-level items, and the Get started CTA.
+      product: tNav("product"),
+      howItWorks: tNav("howItWorks"),
+      howItWorksDesc: tNav("howItWorksDesc"),
+      features: tNav("features"),
+      featuresDesc: tNav("featuresDesc"),
+      faq: tNav("faq"),
+      faqDesc: tNav("faqDesc"),
+      pricing: tNav("pricing"),
+      about: tNav("about"),
+      getStarted: tNav("getStarted"),
       docs: tNav("docs"),
       blog: tNav("blog"),
-      // The scheduling module's booking page (#4633). Present in the map
-      // unconditionally, like `docs` and `blog`: the map is a label lookup, and
-      // an entry for a surface this site did not scaffold is never reached —
-      // `nav-config.ts` only lists surfaces the declared architecture carries.
+      // The scheduling module's booking page, /meet (#4633; renamed from the
+      // schedule/ route by #5563 — the label key itself keeps its name, D1
+      // R2: it names copy, not a route). Present in the map unconditionally,
+      // like `docs` and `blog`: the map is a label lookup, and an entry for
+      // a surface this site did not scaffold is never reached — `nav-config.ts`
+      // only lists surfaces the declared architecture carries.
       schedule: tNav("schedule"),
       // Session-aware action labels (#4984). `account` carries the signed-in
       // user's display name (name, else email) so the Nav shows WHO is signed
@@ -207,8 +253,13 @@ export default async function LocaleLayout({
     closeMenu: tNav("closeMenu"),
   };
   const navOverflowLabel = tNav("moreLinks");
+  // Cookie-consent copy (#5557). The `consent` namespace ships in every
+  // scaffold's messages file; the Banner below is UI-only — OSS ships no
+  // enforcement, the callbacks are the hook for @working-theory/consent.
+  const tConsent = await getTranslations({ locale, namespace: "consent" });
 
-  // Right-side action cluster (#4984). Signed out → a single outline-strong
+  // Right-side action cluster (#4984). Signed out → the Free template's pair
+  // (#5469 D5): a primary "Get started" → /contact beside the outline-strong
   // "Sign in" link (the operator's auth-pair idiom, #4370, MINUS Sign up —
   // this site offers no sign-up flow). Signed in → the user's name (a
   // non-navigating label) + an outline-strong "Sign out"; both authored as
@@ -224,7 +275,10 @@ export default async function LocaleLayout({
           variant: "outline-strong",
         },
       ]
-    : [{ labelKey: "signIn", path: "/sign-in", variant: "outline-strong" }];
+    : [
+        { labelKey: "getStarted", path: "/contact", variant: "primary" },
+        { labelKey: "signIn", path: "/sign-in", variant: "outline-strong" },
+      ];
 
   // Only compose the flow seam when there is a flow action to compose. This
   // layout is a Server Component and `renderFlowTrigger` is a function, so
@@ -237,8 +291,64 @@ export default async function LocaleLayout({
   // this is the caller half of that contract.
   const hasFlowAction = navActions.some((action) => action.kind === "flow");
 
-  // Shared brand mark injected into both Nav and Footer chrome slots.
+  // Shared brand mark injected into both Nav and Footer chrome slots. The
+  // mark comes from site-brand.tsx (the light/dark pair the /sign-in card
+  // also renders); the Nav adds the shipped wordmark beside it so BrandLogo
+  // composes mark + wordmark on desktop and mark-only below `md` (#5469 D5).
   const brandLogo = siteLogo();
+  const brandWordmark = {
+    src: "/wordmark.svg",
+    alt: SITE_NAME,
+    width: 140,
+    height: 16,
+  };
+
+  // The locales the footer's language switcher offers — the same list the
+  // middleware and hreflang alternates read (NEXT_PUBLIC_ENABLED_LOCALES).
+  const enabledLocales = readLocales();
+
+  // The announcement bar is HOME-ONLY (#5469 D5): its route gate matches the
+  // pathname literally, and under next-intl's `as-needed` prefixing the home
+  // path is `/` for the default locale and `/<locale>` for every other one.
+  const homePath = locale === DEFAULT_LOCALE ? "/" : `/${locale}`;
+
+  // Deck home (#5612 D3): `siteChrome.home === "deck"` only ever applies
+  // `snap="mandatory"` + `deckHero` on the locale-root route — every other
+  // path renders byte-identically regardless of the knob. `x-pathname` is the
+  // same header `generateMetadata` above reads (forwarded by middleware.ts);
+  // Next.js's `headers()` is request-scoped and cheap to call again here.
+  const pathname = (await headers()).get("x-pathname") ?? homePath;
+  const isDeckHome = siteChrome.home === "deck" && pathname === homePath;
+
+  // Placeholder social handles + copyright (#5469 D5): `{{COMPANY_HANDLE}}` /
+  // `{{COMPANY_NAME}}` are create-ailk markers substituted at scaffold time
+  // (packages/create-ailk/src/programmatic.ts), so a customer's site never
+  // carries the kit vendor's own identity here. The year is computed, never
+  // typed, so the placeholder does not go stale.
+  const socialLinks = [
+    { platform: "facebook", href: "https://facebook.com/{{COMPANY_HANDLE}}" },
+    { platform: "instagram", href: "https://instagram.com/{{COMPANY_HANDLE}}" },
+    { platform: "x", href: "https://x.com/{{COMPANY_HANDLE}}" },
+    {
+      platform: "linkedin",
+      href: "https://linkedin.com/company/{{COMPANY_HANDLE}}",
+    },
+    { platform: "youtube", href: "https://youtube.com/@{{COMPANY_HANDLE}}" },
+  ] as const;
+  const copyrightText = `© ${new Date().getFullYear()} {{COMPANY_NAME}}`;
+
+  // Footer legal links (#5612 D3). The centered variant folds in FAQ — the
+  // roster's third always-scaffolded core route (`/faq`, alongside `/privacy`
+  // and `/terms`) — since a mark-only nav (its usual pairing, #5589) has
+  // nowhere else on the page linking it. The default `columns` footer keeps
+  // exactly today's two-entry list, byte-identical.
+  const legalLinks = [
+    { label: "Privacy Policy", href: "/privacy" },
+    { label: "Terms of Service", href: "/terms" },
+    ...(siteChrome.footer === "centered"
+      ? [{ label: navLabels.items.faq, href: "/faq" }]
+      : []),
+  ];
 
   // The site's own declared colours, read from `content/_site.mdx`'s `theme:`
   // block and translated from that customer-facing vocabulary onto a token
@@ -257,7 +367,11 @@ export default async function LocaleLayout({
   );
 
   return (
-    <html lang={locale} dir={isRtl(locale) ? "rtl" : "ltr"} data-theme={themeMode}>
+    <html
+      lang={locale}
+      dir={isRtl(locale) ? "rtl" : "ltr"}
+      data-theme={themeMode}
+    >
       <head>
         {/* Flash-prevention: runs synchronously before any styled element */}
         <script
@@ -271,10 +385,24 @@ export default async function LocaleLayout({
         />
         {/* Favicons — single brand mark (theme-independent), PNG fallbacks, ICO legacy */}
         <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
-        <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
-        <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
+        <link
+          rel="icon"
+          type="image/png"
+          sizes="32x32"
+          href="/favicon-32x32.png"
+        />
+        <link
+          rel="icon"
+          type="image/png"
+          sizes="16x16"
+          href="/favicon-16x16.png"
+        />
         <link rel="shortcut icon" href="/favicon.ico" />
-        <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+        <link
+          rel="apple-touch-icon"
+          sizes="180x180"
+          href="/apple-touch-icon.png"
+        />
         <link rel="manifest" href="/site.webmanifest" />
         <GoogleAnalytics />
         <VerificationMeta />
@@ -294,13 +422,35 @@ export default async function LocaleLayout({
            */}
           <MarketingShell
             contentOwnsMain
+            gutters="plain"
+            bannerPlacement="above-nav"
+            {...(siteChrome.announcementBanner
+              ? {
+                  banner: (
+                    <Banner
+                      variant="contrast"
+                      placement="above-nav"
+                      message="Medium length banner heading with link goes here"
+                      action={{ label: "Link", href: "/pricing", kind: "link" }}
+                      routes={{ include: [homePath] }}
+                      dismissible={false}
+                      locale={locale}
+                    />
+                  ),
+                }
+              : {})}
+            {...(isDeckHome
+              ? { snap: "mandatory" as const, deckHero: true }
+              : {})}
             nav={
               <Nav
                 locale={locale}
                 labels={navLabels}
-                navItems={navItems}
+                navItems={siteChrome.nav === "mark-only" ? [] : navItems}
                 siteName={SITE_NAME}
+                showThemeToggle={false}
                 logo={brandLogo}
+                wordmark={brandWordmark}
                 overflowLabel={navOverflowLabel}
                 actions={navActions}
                 {...(hasFlowAction
@@ -327,8 +477,22 @@ export default async function LocaleLayout({
                 navItems={navItems}
                 siteName={SITE_NAME}
                 logo={brandLogo}
-                // #4157 — deliberately left as a literal "Built with AI Launch
-                // Kit" / https://ailaunchkit.ai, not SITE_NAME: this credits
+                social={[...socialLinks]}
+                {...(siteChrome.footer === "centered"
+                  ? { layout: "centered" as const }
+                  : {})}
+                showThemeToggle
+                copyrightText={copyrightText}
+                legalLinks={legalLinks}
+                languageSwitcher={
+                  <LocaleSwitcherNav
+                    current={locale}
+                    locales={enabledLocales}
+                    pathname={pathname}
+                  />
+                }
+                // #4157 — deliberately left as a literal "Built by Working
+                // Theory Labs" / https://ailaunchkit.ai, not SITE_NAME: this credits
                 // the OSS TEMPLATE this site is built with (a "powered by"
                 // link, unconditional in OSS forks per the comment above),
                 // never the customer's own identity, so it isn't the vendor-
@@ -336,7 +500,7 @@ export default async function LocaleLayout({
                 // docs/specs/4157-scaffold-brand-defaults-spec.md § Design
                 // Decisions for the fuller reasoning.
                 attribution={{
-                  label: "Built with AI Launch Kit",
+                  label: "Built by Working Theory Labs",
                   href: "https://ailaunchkit.ai",
                 }}
               />
@@ -344,6 +508,39 @@ export default async function LocaleLayout({
           >
             {children}
           </MarketingShell>
+          {/*
+           * Cookie consent (#5557). Bottom-pinned `info` Banner in consent
+           * mode: `secondaryAction` makes Banner compose BannerConsentIsland,
+           * which reads/writes the `ailk-consent` cookie itself — a fresh
+           * visitor sees it, an accepted/declined one does not, on every
+           * page. Out of the shell's flow (placement `bottom` is a fixed
+           * overlay), so accepting causes no layout shift.
+           */}
+          {consentDecided ? null : (
+            <Banner
+              variant="info"
+              placement="bottom"
+              consentCookieName={CONSENT_COOKIE_NAME}
+              title={tConsent("title")}
+              message={
+                <>
+                  {tConsent("body")}{" "}
+                  <Link
+                    href={localeHref(locale, "/privacy")}
+                    variant="unstyled"
+                    className="font-semibold text-current underline underline-offset-4"
+                  >
+                    {tConsent("policyLinkLabel")}
+                  </Link>
+                </>
+              }
+              dismissible={false}
+              acceptLabel={tConsent("acceptLabel")}
+              secondaryAction={{ label: tConsent("rejectLabel") }}
+              rejectLabel={tConsent("rejectLabel")}
+              locale={locale}
+            />
+          )}
           <Telemetry />
         </NextIntlClientProvider>
       </body>

package/templates/apps/web/components/google-analytics.tsx

@@ -12,11 +12,19 @@
 import Script from "next/script";
 import type { ReactElement } from "react";
 
+import { TOKEN_QUERY_PARAMS } from "../lib/telemetry-scrub";
+
 export function GoogleAnalytics(): ReactElement | null {
   const tagId = process.env.NEXT_PUBLIC_GOOGLE_TAG_ID;
   if (!tagId) {
     return null;
   }
+  // The init script below runs in the browser as raw inline JS, outside any
+  // module graph, so it can't `import` telemetry-scrub.ts — it gets its own
+  // copy of scrubTelemetryUrl, driven by the shared param list, so the
+  // report-grant token (?g=<id>, #5562) never reaches GA's page_location
+  // default (document.location.href) (#5613).
+  const scrubParamsJson = JSON.stringify(TOKEN_QUERY_PARAMS);
   return (
     <>
       <Script
@@ -27,7 +35,16 @@ export function GoogleAnalytics(): ReactElement | null {
         {`window.dataLayer = window.dataLayer || [];
 function gtag(){dataLayer.push(arguments);}
 gtag('js', new Date());
-gtag('config', '${tagId}');`}
+function scrubTelemetryUrl(url) {
+  try {
+    var parsed = new URL(url);
+    ${scrubParamsJson}.forEach(function (param) { parsed.searchParams.delete(param); });
+    return parsed.toString();
+  } catch (e) {
+    return url;
+  }
+}
+gtag('config', '${tagId}', { page_location: scrubTelemetryUrl(window.location.href) });`}
       </Script>
     </>
   );

package/templates/apps/web/eslint.config.mjs

@@ -0,0 +1,69 @@
+// Self-contained ESLint flat config for this scaffolded package.
+//
+// It deliberately does NOT depend on @working-theory/eslint-config — that
+// package is internal to the AI Launch Kit monorepo and is not published, so
+// it cannot be a dependency of a scaffolded starter. Everything below comes
+// from public npm packages already pinned as devDependencies (see
+// package.json): @eslint/js, globals and typescript-eslint.
+//
+// Source file name (#5556): this file is checked in as `_eslint.config.mjs`,
+// not `eslint.config.mjs` — build-templates.mjs renames it at snapshot time
+// (renameScaffoldLintConfigs()). A file literally named `eslint.config.mjs`
+// anywhere under this monorepo (even one this repo's own root eslint.config.ts
+// lists in its `ignores`) is auto-discovered by ESLint's flat-config nested
+// resolution as a competing config root, which breaks the monorepo's own
+// lint runs (verified live: typescript-eslint's "multiple candidate
+// TSConfigRootDirs" parser error across unrelated packages/create-ailk
+// files). The underscore prefix keeps it invisible to that discovery while
+// it lives in this checkout; only the snapshot in templates/ — which ships
+// to the customer, not this repo — gets the real filename.
+import js from "@eslint/js";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  {
+    ignores: [
+      "**/.next/**",
+      "**/dist/**",
+      "**/generated/**",
+      "**/node_modules/**",
+    ],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    languageOptions: {
+      globals: {
+        ...globals.node,
+        ...globals.browser,
+        ...globals.jest,
+      },
+      // Explicit, self-contained root — this scaffold config is never meant
+      // to combine with any sibling scaffold package's config (each ships
+      // standalone), and leaving it unset makes typescript-eslint's
+      // candidate-root disambiguation ambiguous the moment more than one
+      // scaffold package's config resolves in the same ESLint process (e.g.
+      // this monorepo's own `templates/` build, where all four exist
+      // side by side; a real customer scaffold never has that problem,
+      // since it only ever ships and lints ONE of these four at a time).
+      parserOptions: {
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+    rules: {
+      // Downgraded rather than off, so both stay visible without failing a
+      // fresh scaffold's lint:
+      //   - unused-vars: most of the source follows the underscore-prefix
+      //     convention for intentionally-unused bindings, which this rule's
+      //     default options don't recognize; a handful of test fixtures also
+      //     carry genuinely-unused locals this minimal config doesn't try to
+      //     triage file-by-file.
+      //   - require-imports: CommonJS require() is the correct form in Jest
+      //     config/mock files and in a few test-only dynamic re-require
+      //     patterns.
+      "@typescript-eslint/no-unused-vars": "warn",
+      "@typescript-eslint/no-require-imports": "warn",
+    },
+  },
+);

package/templates/apps/web/jest.config.cjs

@@ -58,9 +58,15 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/schema-validator/dist/index.js",
     "^@working-theory/sections-registry$":
       "<rootDir>/node_modules/@working-theory/sections-registry/dist/index.js",
-
     "^@working-theory/templates/shells$":
       "<rootDir>/node_modules/@working-theory/templates/dist/shells/index.js",
+    // Pure-data routes-map subpath (#5572 U2) — mapped directly to source so
+    // a consumer of the lightweight `./routes` export (routes.ts,
+    // next.config.mjs, this suite) never pulls in the templates package's
+    // shells (React/lucide-react) chain, mirroring the same entry in the
+    // root and create-ailk jest configs.
+    "^@working-theory/templates/routes$":
+      "<rootDir>/node_modules/@working-theory/templates/dist/routes-map.js",
     "^@working-theory/templates$": "<rootDir>/node_modules/@working-theory/templates/dist/index.js",
     "^@working-theory/ui$": "<rootDir>/node_modules/@working-theory/ui/dist/index.js",
     "^@working-theory/ui/blocks$": "<rootDir>/node_modules/@working-theory/ui/dist/blocks/index.js",
@@ -69,20 +75,6 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/ui/dist/primitives/index.js",
     "^@working-theory/ui/panels$": "<rootDir>/node_modules/@working-theory/ui/dist/panels/index.js",
     "^@working-theory/ui/sections$": "<rootDir>/node_modules/@working-theory/ui/dist/sections/index.js",
-    // #5214: the scheduling slice's renderer-registration subpath. Mapped to
-    // source like every sibling above — packages/ui/dist isn't built in this
-    // workspace pre-`pnpm build`. The target strips with the slice on the public
-    // tree, where nothing imports it, so the unused mapping is inert there.
-    "^@working-theory/ui/slices/scheduling$":
-      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/scheduling.js",
-    // #5366: the signal-collectors slice's re-export subpath. Same reasoning
-    // as the scheduling mapping above.
-    "^@working-theory/ui/slices/signal-collectors$":
-      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/signal-collectors.js",
-    // #5364: the commerce slice's renderer-registration + CheckoutPriceCard
-    // re-export subpath. Same reasoning as the scheduling mapping above.
-    "^@working-theory/ui/slices/commerce$":
-      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/commerce.js",
     "^@working-theory/theme$": "<rootDir>/node_modules/@working-theory/theme/dist/index.js",
     // site-config publishes ESM in dist/; map to source so ts-jest compiles it
     // through the same transformer as every sibling above. Only the

package/templates/apps/web/lib/__tests__/structured-data.test.tsx

@@ -310,7 +310,7 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
     reason: "interactive flow engine, API-backed",
     subtree: true,
   },
-  { route: "schedule", reason: "booking surface, API-backed", subtree: true },
+  { route: "meet", reason: "booking surface, API-backed", subtree: true },
   { route: "sign-in", reason: "auth surface, not a content page" },
 ];
 
@@ -345,14 +345,36 @@ function exemption(route: string): string | undefined {
   )?.reason;
 }
 
-// The page identity a route renders — the two `renderPage({ type, slug })`
-// shapes tools/lint-check-content-renders.ts recognises (a literal slug, or a
-// slug taken from params). A route that reads its identity another way
-// (e.g. a page-type manifest) is not recognised and must be declared.
+// The page identity a route renders — the three shapes
+// tools/lint-check-content-renders.ts recognises: `renderPage({ type, slug })`
+// with a literal slug, the same with a slug taken from params, and a direct
+// `getMdxSource("<Type>", slug, …)` for a route that composes its own body.
+// This file previously mirrored only the first two and so drifted from the
+// tool its comment names (whose own `GET_MDX_SOURCE_RE` has carried the third
+// arm all along); #5562 restored the parity. A route that reads its identity
+// some other way (e.g. a page-type manifest) is still unrecognised and must
+// be declared.
 const RENDER_PAGE_EXACT_RE =
   /renderPage\s*\(\s*\{[^}]*type\s*:\s*["']([A-Za-z]+)["'][^}]*slug\s*:\s*["']([^"']+)["']/s;
 const RENDER_PAGE_DYNAMIC_RE =
   /renderPage\s*\(\s*\{[^}]*type\s*:\s*["']([A-Za-z]+)["'][^}]*\bslug\s*(?!:\s*["'])/s;
+// A route that composes its own body instead of calling `renderPage` — it
+// resolves content with `getMdxSource(<Type>, slug, locale)` and emits the
+// graph itself via `pageToJsonLd` + `<JsonLdScript>`. That is not a route
+// hiding from this check; it is the SAME declaration one level down, since
+// `renderPage` resolves its own content with exactly this call. `/reports/
+// [slug]` (#5562) is the first: it owns a full-bleed `<main>` and a header
+// section that already renders the title, so `renderPage`'s own `<h1>`/`<p>`
+// would duplicate it.
+//
+// Recognising the shape is deliberately better than exempting the route:
+// an exemption declares "nothing is known to emit JSON-LD here" — false for
+// these routes — and would silence the check for a page that DOES emit a
+// graph. Recognised, the route is rendered and validated like any other.
+// Matched only after both `renderPage` shapes above, so a route that uses
+// `renderPage` is still read through that (richer, slug-bearing) form.
+// Mirrors `GET_MDX_SOURCE_RE` in tools/lint-check-content-renders.ts.
+const GET_MDX_SOURCE_RE = /getMdxSource\s*\(\s*["']([A-Za-z]+)["']/s;
 
 function routeIdentity(
   file: string,
@@ -362,6 +384,11 @@ function routeIdentity(
   if (exact) return { type: exact[1] as string, slug: exact[2] as string };
   const dynamic = RENDER_PAGE_DYNAMIC_RE.exec(src);
   if (dynamic) return { type: dynamic[1] as string, slug: null };
+  // Self-composing route (see GET_MDX_SOURCE_RE). Its slug always comes from
+  // the route params — a self-composing FIXED route would name its slug as a
+  // literal to `getMdxSource`, and none exists — so the dynamic path applies.
+  const ownBody = GET_MDX_SOURCE_RE.exec(src);
+  if (ownBody) return { type: ownBody[1] as string, slug: null };
   return null;
 }
 

package/templates/apps/web/lib/nav-config.ts

@@ -1,13 +1,33 @@
-// nav-config.ts — Nav item registry for apps/web OSS template (#1451)
+// nav-config.ts — Nav item registry for apps/web (#1451, re-shaped by #5469).
 //
-// The OSS template ships a focused navigation inventory — home, docs, and blog.
-// Marketing-site items (pricing, services, about) belong in the per-site fork.
-// Paths are locale-agnostic; Nav prefixes them with the active locale at render.
+// The Free marketing-site template's nav (the approved chrome, #5469 D5):
+// a Product flyout (How it works · Features · FAQ), then How it works,
+// Pricing and About as top-level items. Paths are locale-agnostic; Nav
+// prefixes them with the active locale at render.
+//
+// In a SCAFFOLD this file is regenerated by create-ailk from the declared
+// route surfaces (`renderNavConfig` in packages/create-ailk/src/surfaces.ts)
+// so the nav never links a page the scaffold does not carry — keep the two in
+// step when the base item set changes.
 
 import type { NavItem } from "@working-theory/ui";
+import { BookOpen, HelpCircle, Layers, Sparkles } from "lucide-react";
 
 export const navItems: NavItem[] = [
-  { labelKey: "home", path: "/" },
-  { labelKey: "docs", path: "/docs" },
-  { labelKey: "blog", path: "/blog" },
+  {
+    labelKey: "product",
+    flyout: {
+      presentation: "list",
+      width: "trigger",
+      features: [
+        { labelKey: "howItWorks", descKey: "howItWorksDesc", icon: Layers, path: "/how-it-works" },
+        { labelKey: "features", descKey: "featuresDesc", icon: Sparkles, path: "/features" },
+        { labelKey: "faq", descKey: "faqDesc", icon: HelpCircle, path: "/faq" },
+      ],
+      actions: [{ labelKey: "docs", icon: BookOpen, path: "/how-it-works" }],
+    },
+  },
+  { labelKey: "howItWorks", path: "/how-it-works" },
+  { labelKey: "pricing", path: "/pricing" },
+  { labelKey: "about", path: "/about" },
 ];

package/templates/apps/web/lib/server-api.ts

@@ -17,7 +17,7 @@
  * hand-rolled `fetch`. This module supplies exactly the two things that
  * namespace doesn't own: the cookie/origin-forwarding `init` (B0's additive
  * `init?: { headers }` on `http.get`) and the envelope→`ApiError` unwrap
- * (mirrors `apps-paid/workspace/lib/api-error.ts`'s `unwrapEnvelope`, adapted to
+ * (mirrors `apps-paid/admin/lib/api-error.ts`'s `unwrapEnvelope`, adapted to
  * the `@working-theory/api-client` `ApiResult<T>` shape B0 already returns
  * rather than re-parsing the wire envelope by hand).
  */

package/templates/apps/web/lib/site-chrome.ts

@@ -0,0 +1,29 @@
+// site-chrome.ts — resolved template layout knobs.
+//
+// GENERATED by create-ailk from the declared template's `layout` block
+// (#5612). A scaffold with no template, or a template with no `layout`
+// block, gets these defaults — byte-identical to every scaffold before this
+// file existed. `apps/web/app/[locale]/layout.tsx` reads this to decide:
+//   - nav: "mark-only" → Nav renders the brand mark + right-hand controls
+//     only (no nav links).
+//   - footer: "centered" → Footer renders its existing centered variant.
+//   - announcementBanner: false → the home-only announcement Banner is not
+//     mounted (the cookie-consent Banner is unaffected — it is not an
+//     announcement).
+//   - home: "deck" → the locale-root route mounts MarketingShell with
+//     snap="mandatory" + deckHero (spec 5426 D7); every other route is
+//     unaffected.
+
+export interface SiteChrome {
+  nav: "full" | "mark-only";
+  footer: "columns" | "centered";
+  announcementBanner: boolean;
+  home: "default" | "deck";
+}
+
+export const siteChrome: SiteChrome = {
+  nav: "full",
+  footer: "columns",
+  announcementBanner: true,
+  home: "default",
+};