create-ailk 0.4.0 → 0.6.0

package/templates/apps/web/components/google-analytics.tsx

@@ -12,11 +12,19 @@
 import Script from "next/script";
 import type { ReactElement } from "react";
 
+import { TOKEN_QUERY_PARAMS } from "../lib/telemetry-scrub";
+
 export function GoogleAnalytics(): ReactElement | null {
   const tagId = process.env.NEXT_PUBLIC_GOOGLE_TAG_ID;
   if (!tagId) {
     return null;
   }
+  // The init script below runs in the browser as raw inline JS, outside any
+  // module graph, so it can't `import` telemetry-scrub.ts — it gets its own
+  // copy of scrubTelemetryUrl, driven by the shared param list, so the
+  // report-grant token (?g=<id>, #5562) never reaches GA's page_location
+  // default (document.location.href) (#5613).
+  const scrubParamsJson = JSON.stringify(TOKEN_QUERY_PARAMS);
   return (
     <>
       <Script
@@ -27,7 +35,16 @@ export function GoogleAnalytics(): ReactElement | null {
         {`window.dataLayer = window.dataLayer || [];
 function gtag(){dataLayer.push(arguments);}
 gtag('js', new Date());
-gtag('config', '${tagId}');`}
+function scrubTelemetryUrl(url) {
+  try {
+    var parsed = new URL(url);
+    ${scrubParamsJson}.forEach(function (param) { parsed.searchParams.delete(param); });
+    return parsed.toString();
+  } catch (e) {
+    return url;
+  }
+}
+gtag('config', '${tagId}', { page_location: scrubTelemetryUrl(window.location.href) });`}
       </Script>
     </>
   );

package/templates/apps/web/eslint.config.mjs

@@ -0,0 +1,69 @@
+// Self-contained ESLint flat config for this scaffolded package.
+//
+// It deliberately does NOT depend on @working-theory/eslint-config — that
+// package is internal to the AI Launch Kit monorepo and is not published, so
+// it cannot be a dependency of a scaffolded starter. Everything below comes
+// from public npm packages already pinned as devDependencies (see
+// package.json): @eslint/js, globals and typescript-eslint.
+//
+// Source file name (#5556): this file is checked in as `_eslint.config.mjs`,
+// not `eslint.config.mjs` — build-templates.mjs renames it at snapshot time
+// (renameScaffoldLintConfigs()). A file literally named `eslint.config.mjs`
+// anywhere under this monorepo (even one this repo's own root eslint.config.ts
+// lists in its `ignores`) is auto-discovered by ESLint's flat-config nested
+// resolution as a competing config root, which breaks the monorepo's own
+// lint runs (verified live: typescript-eslint's "multiple candidate
+// TSConfigRootDirs" parser error across unrelated packages/create-ailk
+// files). The underscore prefix keeps it invisible to that discovery while
+// it lives in this checkout; only the snapshot in templates/ — which ships
+// to the customer, not this repo — gets the real filename.
+import js from "@eslint/js";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  {
+    ignores: [
+      "**/.next/**",
+      "**/dist/**",
+      "**/generated/**",
+      "**/node_modules/**",
+    ],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    languageOptions: {
+      globals: {
+        ...globals.node,
+        ...globals.browser,
+        ...globals.jest,
+      },
+      // Explicit, self-contained root — this scaffold config is never meant
+      // to combine with any sibling scaffold package's config (each ships
+      // standalone), and leaving it unset makes typescript-eslint's
+      // candidate-root disambiguation ambiguous the moment more than one
+      // scaffold package's config resolves in the same ESLint process (e.g.
+      // this monorepo's own `templates/` build, where all four exist
+      // side by side; a real customer scaffold never has that problem,
+      // since it only ever ships and lints ONE of these four at a time).
+      parserOptions: {
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+    rules: {
+      // Downgraded rather than off, so both stay visible without failing a
+      // fresh scaffold's lint:
+      //   - unused-vars: most of the source follows the underscore-prefix
+      //     convention for intentionally-unused bindings, which this rule's
+      //     default options don't recognize; a handful of test fixtures also
+      //     carry genuinely-unused locals this minimal config doesn't try to
+      //     triage file-by-file.
+      //   - require-imports: CommonJS require() is the correct form in Jest
+      //     config/mock files and in a few test-only dynamic re-require
+      //     patterns.
+      "@typescript-eslint/no-unused-vars": "warn",
+      "@typescript-eslint/no-require-imports": "warn",
+    },
+  },
+);

package/templates/apps/web/jest.config.cjs

@@ -58,9 +58,15 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/schema-validator/dist/index.js",
     "^@working-theory/sections-registry$":
       "<rootDir>/node_modules/@working-theory/sections-registry/dist/index.js",
-
     "^@working-theory/templates/shells$":
       "<rootDir>/node_modules/@working-theory/templates/dist/shells/index.js",
+    // Pure-data routes-map subpath (#5572 U2) — mapped directly to source so
+    // a consumer of the lightweight `./routes` export (routes.ts,
+    // next.config.mjs, this suite) never pulls in the templates package's
+    // shells (React/lucide-react) chain, mirroring the same entry in the
+    // root and create-ailk jest configs.
+    "^@working-theory/templates/routes$":
+      "<rootDir>/node_modules/@working-theory/templates/dist/routes-map.js",
     "^@working-theory/templates$": "<rootDir>/node_modules/@working-theory/templates/dist/index.js",
     "^@working-theory/ui$": "<rootDir>/node_modules/@working-theory/ui/dist/index.js",
     "^@working-theory/ui/blocks$": "<rootDir>/node_modules/@working-theory/ui/dist/blocks/index.js",
@@ -69,20 +75,6 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/ui/dist/primitives/index.js",
     "^@working-theory/ui/panels$": "<rootDir>/node_modules/@working-theory/ui/dist/panels/index.js",
     "^@working-theory/ui/sections$": "<rootDir>/node_modules/@working-theory/ui/dist/sections/index.js",
-    // #5214: the scheduling slice's renderer-registration subpath. Mapped to
-    // source like every sibling above — packages/ui/dist isn't built in this
-    // workspace pre-`pnpm build`. The target strips with the slice on the public
-    // tree, where nothing imports it, so the unused mapping is inert there.
-    "^@working-theory/ui/slices/scheduling$":
-      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/scheduling.js",
-    // #5366: the signal-collectors slice's re-export subpath. Same reasoning
-    // as the scheduling mapping above.
-    "^@working-theory/ui/slices/signal-collectors$":
-      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/signal-collectors.js",
-    // #5364: the commerce slice's renderer-registration + CheckoutPriceCard
-    // re-export subpath. Same reasoning as the scheduling mapping above.
-    "^@working-theory/ui/slices/commerce$":
-      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/commerce.js",
     "^@working-theory/theme$": "<rootDir>/node_modules/@working-theory/theme/dist/index.js",
     // site-config publishes ESM in dist/; map to source so ts-jest compiles it
     // through the same transformer as every sibling above. Only the
@@ -92,11 +84,15 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/site-config/dist/schema/index.js",
     "^@working-theory/validation$": "<rootDir>/node_modules/@working-theory/validation/dist/index.js",
     "^@working-theory/web-i18n$": "<rootDir>/node_modules/@working-theory/web-i18n/dist/index.js",
-    // The dependency-free tenancy-constants subpath (database/tenancy.ts —
-    // it imports only a type from @working-theory/ids). Mapped to source like
-    // every sibling above; `database/dist` is not built in this workspace
-    // pre-`pnpm build`.
+    // The dependency-free tenancy-constants subpath (database/tenancy.ts).
+    // Mapped to source like every sibling above; `database/dist` is not
+    // built in this workspace pre-`pnpm build`.
     "^@working-theory/database/tenancy$": "<rootDir>/node_modules/@working-theory/database/dist/tenancy.js",
+    // #5876: database/tenancy.ts imports isSentinel as a VALUE (not just the
+    // Id type) from @working-theory/ids, so ts-jest needs it resolvable at
+    // runtime here too — mirrors the same mapping added to
+    // database/jest.config.cjs and apps/mcp/jest.config.cjs.
+    "^@working-theory/ids$": "<rootDir>/node_modules/@working-theory/ids/dist/index.js",
     // #5025: pnpm keys next-intl's virtual-store path on its resolved peers,
     // so apps/web and packages/page-renderer can link two PHYSICALLY DISTINCT
     // copies of the same version — and a `jest.mock("next-intl/server")` in

package/templates/apps/web/lib/__tests__/auth-email.test.ts

@@ -0,0 +1,214 @@
+/**
+ * @file auth-email.test.ts — Better Auth's three mail callbacks (#5962 § D3).
+ *
+ * Written before the implementation. The transport is INJECTED, so nothing
+ * here mocks an internal module and nothing here sends mail.
+ *
+ * What the suite pins, in the order the design depends on it:
+ *   - ONE serialization: the bytes that are signed are the bytes that are
+ *     sent. A key-order or whitespace drift between signer and sender is the
+ *     whole failure mode the raw-string seam exists to make impossible.
+ *   - the signature is HMAC-SHA256 over `<timestamp>.<body>`, so the
+ *     timestamp cannot be swapped independently of the body it authenticates.
+ *   - the credential-account check (§ D14): a user with no `credential`
+ *     account gets NO reset mail, and the suppression is silent — same return,
+ *     no throw, log-only. An OAuth-only user who completes a reset would
+ *     otherwise silently gain a password path around their IdP.
+ *   - the § D12 PII boundary on every log line: a userId, a kind, a reason and
+ *     an error KIND. Never the address, never the token, never the link.
+ *   - nothing throws. A failed notification must never fail the password
+ *     change it reports.
+ */
+
+import type { AuthEmailLog } from "../auth-email";
+import {
+  buildAuthEmailRequest,
+  makeSendResetPassword,
+  makeSendVerificationEmail,
+  makeSendPasswordChangedNotice,
+} from "../auth-email";
+
+const ORIGINAL_ENV = process.env;
+
+type LogLine = { level: string; fields: Record<string, unknown> };
+
+function makeLog(): { lines: LogLine[]; log: AuthEmailLog } {
+  const lines: LogLine[] = [];
+  const record =
+    (level: string) =>
+    (fields: Record<string, unknown>): void => {
+      lines.push({ level, fields });
+    };
+  return { lines, log: { warn: record("warn"), info: record("info") } };
+}
+
+/** A prisma double exposing only what these callbacks touch. */
+function makePrisma(hasCredential: boolean) {
+  return {
+    account: {
+      findFirst: jest.fn().mockResolvedValue(
+        hasCredential ? { id: "acct_1" } : null,
+      ),
+    },
+    verification: { deleteMany: jest.fn().mockResolvedValue({ count: 2 }) },
+  };
+}
+
+beforeEach(() => {
+  process.env = { ...ORIGINAL_ENV };
+  process.env.AUTH_EMAIL_WEBHOOK_SECRET = "webhook-secret";
+  process.env.AUTH_EMAIL_FROM = "noreply@site.example";
+  process.env.BETTER_AUTH_URL = "https://site.example";
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+describe("buildAuthEmailRequest()", () => {
+  it("signs the EXACT string it returns as the body", () => {
+    const req = buildAuthEmailRequest(
+      { kind: "password-reset", userId: "user_1", to: "a@b.test", url: "https://site.example/r" },
+      "webhook-secret",
+    );
+
+    const { createHmac } = require("node:crypto") as typeof import("node:crypto");
+    const timestamp = req.headers["x-ailk-auth-email-timestamp"];
+    const expected = `sha256=${createHmac("sha256", "webhook-secret")
+      .update(`${timestamp}.${req.rawBody}`, "utf8")
+      .digest("hex")}`;
+
+    expect(req.headers["x-ailk-auth-email-signature"]).toBe(expected);
+    // And the body really is a single string, not an object re-serialized later.
+    expect(typeof req.rawBody).toBe("string");
+    expect(JSON.parse(req.rawBody)).toMatchObject({
+      kind: "password-reset",
+      userId: "user_1",
+      to: "a@b.test",
+    });
+  });
+
+  it("puts a current unix-seconds timestamp inside the signed material", () => {
+    const req = buildAuthEmailRequest(
+      { kind: "password-changed", userId: "user_1", to: "a@b.test" },
+      "webhook-secret",
+    );
+    const ts = Number(req.headers["x-ailk-auth-email-timestamp"]);
+    expect(Math.abs(Math.floor(Date.now() / 1000) - ts)).toBeLessThan(5);
+  });
+});
+
+describe("sendResetPassword (§ D14 — the credential-account check)", () => {
+  it("sends for a user who HAS a credential account", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { lines, log } = makeLog();
+    const prisma = makePrisma(true);
+
+    const cb = makeSendResetPassword({ prisma, send, log });
+    await cb({ user: { id: "user_1", email: "person@example.com" }, url: "https://site.example/api/auth/reset-password/tok" });
+
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(lines.some((l) => l.fields.reason === "sent")).toBe(true);
+  });
+
+  it("sends NOTHING for a user with no credential account, and does not throw", async () => {
+    const send = jest.fn();
+    const { lines, log } = makeLog();
+    const prisma = makePrisma(false);
+
+    const cb = makeSendResetPassword({ prisma, send, log });
+    await expect(
+      cb({ user: { id: "user_1", email: "person@example.com" }, url: "https://site.example/x" }),
+    ).resolves.toBeUndefined();
+
+    expect(send).not.toHaveBeenCalled();
+    expect(lines.some((l) => l.fields.reason === "no_credential_account")).toBe(
+      true,
+    );
+  });
+
+  it("never throws when the transport fails", async () => {
+    const send = jest.fn().mockRejectedValue(new Error("network"));
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+
+    await expect(
+      cb({ user: { id: "user_1", email: "p@e.test" }, url: "https://site.example/x" }),
+    ).resolves.toBeUndefined();
+    expect(lines.some((l) => l.fields.reason === "send_failed")).toBe(true);
+  });
+
+  it("logs nothing when the relay secret is absent — it does not send blind", async () => {
+    delete process.env.AUTH_EMAIL_WEBHOOK_SECRET;
+    const send = jest.fn();
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+
+    await cb({ user: { id: "user_1", email: "p@e.test" }, url: "https://site.example/x" });
+    expect(send).not.toHaveBeenCalled();
+    expect(lines.some((l) => l.fields.reason === "not_configured")).toBe(true);
+  });
+});
+
+describe("the § D12 PII boundary", () => {
+  it("never logs the address, the token or the assembled link", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { lines, log } = makeLog();
+    const url =
+      "https://site.example/api/auth/reset-password/SECRETTOKEN?callbackURL=%2Freset-password";
+
+    const reset = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+    await reset({ user: { id: "user_1", email: "person@example.com" }, url });
+
+    const verify = makeSendVerificationEmail({ send, log });
+    await verify({ user: { id: "user_1", email: "person@example.com" }, url });
+
+    const notice = makeSendPasswordChangedNotice({ send, log });
+    await notice({ id: "user_1", email: "person@example.com" });
+
+    const serialized = JSON.stringify(lines);
+    expect(serialized).not.toContain("person@example.com");
+    expect(serialized).not.toContain("SECRETTOKEN");
+    expect(serialized).not.toContain("site.example");
+    // What it DOES carry.
+    expect(serialized).toContain("user_1");
+    expect(serialized).toContain("password-reset");
+  });
+
+  it("carries only the tagged error KIND, never a message that can quote an address", async () => {
+    const send = jest.fn().mockResolvedValue({
+      ok: false,
+      status: 400,
+      body: { error: "validation_failed for person@example.com" },
+    });
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+
+    await cb({ user: { id: "user_1", email: "person@example.com" }, url: "https://site.example/x" });
+    expect(JSON.stringify(lines)).not.toContain("person@example.com");
+  });
+});
+
+describe("makeSendPasswordChangedNotice (§ D17)", () => {
+  it("sends a password-changed body carrying no url", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { log } = makeLog();
+    const notice = makeSendPasswordChangedNotice({ send, log });
+
+    await notice({ id: "user_1", email: "person@example.com" });
+
+    const [rawBody] = send.mock.calls[0];
+    const parsed = JSON.parse(rawBody);
+    expect(parsed.kind).toBe("password-changed");
+    expect(parsed).not.toHaveProperty("url");
+  });
+
+  it("never throws — a failed notice must not fail the password change", async () => {
+    const send = jest.fn().mockRejectedValue(new Error("down"));
+    const { log } = makeLog();
+    const notice = makeSendPasswordChangedNotice({ send, log });
+    await expect(
+      notice({ id: "user_1", email: "person@example.com" }),
+    ).resolves.toBeUndefined();
+  });
+});

package/templates/apps/web/lib/__tests__/auth-routes.test.ts

@@ -0,0 +1,74 @@
+/**
+ * Tests for the auth-route predicate (#5963).
+ *
+ * `isAuthPath()` is the ONE list the locale layout branches on and the five
+ * `(auth)` page segments are named from, so the layout and the routes cannot
+ * drift. Covers bare paths, locale-prefixed paths, near misses, nested paths,
+ * and the absent-header fail-safe.
+ */
+
+import { AUTH_SEGMENTS, isAuthPath } from "../auth-routes";
+
+const LOCALES = ["en", "fr", "de"];
+
+describe("AUTH_SEGMENTS", () => {
+  it("names exactly the five auth routes", () => {
+    expect([...AUTH_SEGMENTS]).toEqual([
+      "sign-in",
+      "sign-up",
+      "forgot-password",
+      "reset-password",
+      "verify-email",
+    ]);
+  });
+});
+
+describe("isAuthPath", () => {
+  it.each(AUTH_SEGMENTS)("matches the bare /%s path", (segment) => {
+    expect(isAuthPath(`/${segment}`, LOCALES)).toBe(true);
+  });
+
+  it.each(AUTH_SEGMENTS)("matches the locale-prefixed /fr/%s path", (segment) => {
+    expect(isAuthPath(`/fr/${segment}`, LOCALES)).toBe(true);
+  });
+
+  it("matches a trailing-slash auth path", () => {
+    expect(isAuthPath("/sign-in/", LOCALES)).toBe(true);
+  });
+
+  it("matches an auth path carrying a query string", () => {
+    expect(isAuthPath("/sign-in?next=/account", LOCALES)).toBe(true);
+  });
+
+  it("matches a nested path under an auth segment", () => {
+    expect(isAuthPath("/reset-password/confirm", LOCALES)).toBe(true);
+  });
+
+  it("does not match a near miss", () => {
+    expect(isAuthPath("/sign-in-x", LOCALES)).toBe(false);
+    expect(isAuthPath("/sign", LOCALES)).toBe(false);
+  });
+
+  it("does not match a marketing path", () => {
+    expect(isAuthPath("/pricing", LOCALES)).toBe(false);
+    expect(isAuthPath("/fr/pricing", LOCALES)).toBe(false);
+  });
+
+  it("does not match the locale root or the site root", () => {
+    expect(isAuthPath("/", LOCALES)).toBe(false);
+    expect(isAuthPath("/fr", LOCALES)).toBe(false);
+  });
+
+  it("does not strip a prefix that is not an enabled locale", () => {
+    // `/es` is not enabled here, so `es` is the first segment, not a prefix.
+    expect(isAuthPath("/es/sign-in", LOCALES)).toBe(false);
+  });
+
+  it("fails to NOT-an-auth-path for an empty or absent pathname", () => {
+    // The fail-safe direction (§ D1): an absent `x-pathname` must never strip
+    // a marketing page's chrome. The worst case is an auth page WITH chrome,
+    // which the (auth) group's own tests catch.
+    expect(isAuthPath("", LOCALES)).toBe(false);
+    expect(isAuthPath(undefined, LOCALES)).toBe(false);
+  });
+});

package/templates/apps/web/lib/__tests__/meeting-slugs.test.ts

@@ -0,0 +1,72 @@
+// oss: false
+/**
+ * Tests for enabledMeetingSlugs (#6183 S9b D5) — the D4-resolving read both
+ * /meet pages share.
+ */
+const mockMeetingTypes = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  schedule: { meetingTypes: (...args: unknown[]) => mockMeetingTypes(...args) },
+}));
+
+import { enabledMeetingSlugs } from "../meeting-slugs";
+
+describe("enabledMeetingSlugs", () => {
+  const originalEnv = process.env["SCHEDULING_CAL_LINK"];
+
+  beforeEach(() => {
+    mockMeetingTypes.mockReset();
+  });
+
+  afterEach(() => {
+    if (originalEnv === undefined) delete process.env["SCHEDULING_CAL_LINK"];
+    else process.env["SCHEDULING_CAL_LINK"] = originalEnv;
+  });
+
+  it("passes a real, populated array through unchanged", async () => {
+    mockMeetingTypes.mockResolvedValue({
+      ok: true,
+      body: { slugs: ["intro", "demo"] },
+    });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual(["intro", "demo"]);
+  });
+
+  it("passes a real, intentionally empty array through unchanged (D4 row 2 — never the fallback)", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: [] } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+
+  it("null + SCHEDULING_CAL_LINK set → the derived singleton (D4 row 1)", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual(["intro-call"]);
+  });
+
+  it("null + SCHEDULING_CAL_LINK unset → [] (no shipped page to protect)", async () => {
+    delete process.env["SCHEDULING_CAL_LINK"];
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+
+  it("a non-ok API result → [], fail closed — an outage must not open the gate", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: false, status: 500, body: null });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+
+  it("null + a MALFORMED SCHEDULING_CAL_LINK slug → [], never a corrupt fallback (D14 parity, security review 2026-09-19)", async () => {
+    // A comma in the derived slug would corrupt the batched event-meta
+    // `calLinks` join downstream (it splits on comma), misattributing the
+    // rest of the list to a foreign owner — MeetingSlugSchema rejects it.
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro,evil";
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+});

package/templates/apps/web/lib/__tests__/structured-data.test.tsx

@@ -310,8 +310,25 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
     reason: "interactive flow engine, API-backed",
     subtree: true,
   },
-  { route: "schedule", reason: "booking surface, API-backed", subtree: true },
-  { route: "sign-in", reason: "auth surface, not a content page" },
+  { route: "meet", reason: "booking surface, API-backed", subtree: true },
+  // #6084 — both purchase return pages read a Checkout Session (or read
+  // nothing, for cancel) and render via SectionRenderer directly; neither
+  // is a content-adapter page, and the paid render's own schema.org node
+  // (`PaymentComplete`, D6) is asserted directly, not through this walk.
+  {
+    route: "purchase",
+    reason: "checkout return pages, API-backed / read-nothing",
+    subtree: true,
+  },
+  // The whole (auth) route group (#5963). The walk keys on the DIRECTORY
+  // path, and a route group's parens are part of it, so this one subtree
+  // entry covers all five auth pages — including /sign-in, whose own entry it
+  // replaces now that the page sits inside the group.
+  {
+    route: "(auth)",
+    reason: "auth surfaces, not content pages",
+    subtree: true,
+  },
 ];
 
 interface RouteEntry {
@@ -345,14 +362,36 @@ function exemption(route: string): string | undefined {
   )?.reason;
 }
 
-// The page identity a route renders — the two `renderPage({ type, slug })`
-// shapes tools/lint-check-content-renders.ts recognises (a literal slug, or a
-// slug taken from params). A route that reads its identity another way
-// (e.g. a page-type manifest) is not recognised and must be declared.
+// The page identity a route renders — the three shapes
+// tools/lint-check-content-renders.ts recognises: `renderPage({ type, slug })`
+// with a literal slug, the same with a slug taken from params, and a direct
+// `getMdxSource("<Type>", slug, …)` for a route that composes its own body.
+// This file previously mirrored only the first two and so drifted from the
+// tool its comment names (whose own `GET_MDX_SOURCE_RE` has carried the third
+// arm all along); #5562 restored the parity. A route that reads its identity
+// some other way (e.g. a page-type manifest) is still unrecognised and must
+// be declared.
 const RENDER_PAGE_EXACT_RE =
   /renderPage\s*\(\s*\{[^}]*type\s*:\s*["']([A-Za-z]+)["'][^}]*slug\s*:\s*["']([^"']+)["']/s;
 const RENDER_PAGE_DYNAMIC_RE =
   /renderPage\s*\(\s*\{[^}]*type\s*:\s*["']([A-Za-z]+)["'][^}]*\bslug\s*(?!:\s*["'])/s;
+// A route that composes its own body instead of calling `renderPage` — it
+// resolves content with `getMdxSource(<Type>, slug, locale)` and emits the
+// graph itself via `pageToJsonLd` + `<JsonLdScript>`. That is not a route
+// hiding from this check; it is the SAME declaration one level down, since
+// `renderPage` resolves its own content with exactly this call. `/reports/
+// [slug]` (#5562) is the first: it owns a full-bleed `<main>` and a header
+// section that already renders the title, so `renderPage`'s own `<h1>`/`<p>`
+// would duplicate it.
+//
+// Recognising the shape is deliberately better than exempting the route:
+// an exemption declares "nothing is known to emit JSON-LD here" — false for
+// these routes — and would silence the check for a page that DOES emit a
+// graph. Recognised, the route is rendered and validated like any other.
+// Matched only after both `renderPage` shapes above, so a route that uses
+// `renderPage` is still read through that (richer, slug-bearing) form.
+// Mirrors `GET_MDX_SOURCE_RE` in tools/lint-check-content-renders.ts.
+const GET_MDX_SOURCE_RE = /getMdxSource\s*\(\s*["']([A-Za-z]+)["']/s;
 
 function routeIdentity(
   file: string,
@@ -362,6 +401,11 @@ function routeIdentity(
   if (exact) return { type: exact[1] as string, slug: exact[2] as string };
   const dynamic = RENDER_PAGE_DYNAMIC_RE.exec(src);
   if (dynamic) return { type: dynamic[1] as string, slug: null };
+  // Self-composing route (see GET_MDX_SOURCE_RE). Its slug always comes from
+  // the route params — a self-composing FIXED route would name its slug as a
+  // literal to `getMdxSource`, and none exists — so the dynamic path applies.
+  const ownBody = GET_MDX_SOURCE_RE.exec(src);
+  if (ownBody) return { type: ownBody[1] as string, slug: null };
   return null;
 }