create-ailk 0.5.0 → 0.6.1

package/templates/apps/web/app/[locale]/(authed)/account/actions.ts

@@ -0,0 +1,58 @@
+"use server";
+
+/**
+ * account/actions.ts — the update-your-card banner's Server Action (#6038,
+ * D5): mints a Stripe billing-portal session on SUBMIT, never on render, and
+ * hands the browser straight to it via `redirect()`.
+ *
+ * The portal URL is never embedded in page data — it is created here, on
+ * click, and never rendered into HTML or a client bundle (D5's precise
+ * claim: `redirect()` DOES surface the target in the address bar/history/
+ * navigation telemetry for a Server Action, which is inherent to any hosted-
+ * portal handoff, not something this design avoids).
+ *
+ * CSRF is already handled: `forwardedCookieInit()` forwards the incoming
+ * request's real `Origin` alongside the cookie, and `apps/api`'s
+ * `authPreHandler` requires a matching `Origin` on this cookie-authenticated
+ * mutating request (D3.1/D5).
+ *
+ * `redirect()` throws `NEXT_REDIRECT` by design — called OUTSIDE the
+ * try/catch (mirrors `checkout.actions.ts`'s idiom) so the catch never
+ * swallows the navigation this action exists to perform.
+ */
+
+import { subscription } from "@working-theory/api-client";
+import { redirect } from "next/navigation";
+
+import { forwardedCookieInit } from "../../../../lib/server-api";
+
+/** PII-safe error identity for logs (the `checkout.actions.ts` idiom: `err.name` only). */
+function errorName(err: unknown): string {
+  return err instanceof Error ? err.name : "unknown";
+}
+
+/**
+ * Opens the caller's own Stripe billing-portal session and redirects there.
+ * Never returns on success. On a non-2xx or thrown error, logs a PII-safe
+ * status/name and redirects back to `/account` unchanged (the banner's
+ * action-unavailable posture — there is no error UI slot on this button).
+ */
+export async function openBillingPortal(): Promise<void> {
+  const init = await forwardedCookieInit();
+
+  let url: string;
+  try {
+    const res = await subscription.portalSession(init);
+    if (!res.ok) {
+      console.error(`[openBillingPortal] status=${res.status}`);
+      return;
+    }
+    url = res.body.url;
+  } catch (err) {
+    console.error(`[openBillingPortal] errName=${errorName(err)}`);
+    return;
+  }
+
+  // Outside the try/catch on purpose — see the file header.
+  redirect(url);
+}

package/templates/apps/web/app/[locale]/(authed)/account/page.tsx

@@ -1,16 +1,18 @@
 /**
- * /[locale]/account — the signed-in respondent's own profile, results, and
- * purchases (#4984).
+ * /[locale]/account — the signed-in respondent's own profile, results,
+ * purchases, and subscription status (#4984, #6038).
  *
  * RSC. The `(authed)` layout is the gate — it already resolved a session or
  * rendered `SignInGate`; this page reads the session again ONLY for the
  * profile fields (name / email / verified). Every data read goes through
  * `@working-theory/api-client` with the caller's cookie forwarded
  * (`../../../../lib/server-api`, D9): `waitlistSignups.me(key)` once per key
- * in `lib/account-config.ts` (Results) and `flowCheckouts.me()` (Purchases).
- * A 404 (no signup / no user row for that key) or a 401/403 (session missing,
- * email unverified — the profile row already says so) is skipped, never
- * thrown; every other error rethrows to the route error boundary.
+ * in `lib/account-config.ts` (Results), `flowCheckouts.me()` (Purchases),
+ * and `subscription.me()` (the update-your-card banner, #6038). A 404 (no
+ * signup / no user row for that key / commerce module off) or a 401/403
+ * (session missing, email unverified — the profile row already says so) is
+ * skipped, never thrown; every other error rethrows to the route error
+ * boundary.
  *
  * Chrome: this page composes `AppShell` + `SidebarNav` directly, with this
  * page's own three in-page anchors. The page renders inside the locale
@@ -20,16 +22,19 @@
 
 import {
   flowCheckouts,
+  subscription,
   waitlistSignups,
   type FlowCheckoutMeItem,
+  type SubscriptionMeResponse,
   type WaitlistSignupMeResponse,
 } from "@working-theory/api-client";
 import { AppShell } from "@working-theory/templates/shells";
 import { localeHref } from "@working-theory/ui";
-import { DescriptionList } from "@working-theory/ui/blocks";
+import { DescriptionList, SubscriptionStatusBanner } from "@working-theory/ui/blocks";
 import { SidebarNav, type SidebarNavItem } from "@working-theory/ui/chrome";
 import {
   Badge,
+  Button,
   EmptyState,
   Heading,
   MoneyAmount,
@@ -53,6 +58,7 @@ import { forwardedCookieInit, unwrapApiResult } from "../../../../lib/server-api
 import { ForbiddenState } from "../waitlist/components/ForbiddenState";
 import { formatCount, formatDateTime } from "../waitlist/format";
 
+import { openBillingPortal } from "./actions";
 import { SignOutButton } from "./sign-out-button";
 
 interface Props {
@@ -93,6 +99,19 @@ async function readCheckouts(init: CookieInit): Promise<FlowCheckoutMeItem[]> {
   return unwrapApiResult(Promise.resolve(res));
 }
 
+/**
+ * The update-your-card banner's read (#6038). `null` covers both "nothing
+ * to show" (401/403/404 — the commerce-disabled-build 404 included, D8) and
+ * "no row" (a healthy subscriber, `actionRequired: false`) — the page's
+ * render condition below is `sub?.actionRequired`, so both collapse to no
+ * banner without a separate branch.
+ */
+async function readSubscription(init: CookieInit): Promise<SubscriptionMeResponse | null> {
+  const res = await subscription.me(init);
+  if (!res.ok && SKIPPED_STATUSES.has(res.status)) return null; // AC-4, the existing constant
+  return unwrapApiResult(Promise.resolve(res));
+}
+
 export default async function AccountPage({ params }: Props): Promise<ReactElement> {
   const { locale } = await params;
   const t = await getTranslations({ locale, namespace: "account" });
@@ -112,7 +131,11 @@ export default async function AccountPage({ params }: Props): Promise<ReactEleme
   }
 
   const init = await forwardedCookieInit();
-  const [signups, checkouts] = await Promise.all([readSignups(init), readCheckouts(init)]);
+  const [signups, checkouts, sub] = await Promise.all([
+    readSignups(init),
+    readCheckouts(init),
+    readSubscription(init),
+  ]);
 
   const { name, email, emailVerified } = session.user;
   const displayName = name || email;
@@ -145,6 +168,38 @@ export default async function AccountPage({ params }: Props): Promise<ReactEleme
           </Text>
         </div>
 
+        {sub?.actionRequired ? (
+          <SubscriptionStatusBanner
+            headline={t("subscription.headline")}
+            description={
+              sub.status === "canceled" && sub.accessRevokesAt
+                ? t("subscription.descriptionCanceled", {
+                    date: formatDateTime(sub.accessRevokesAt, locale),
+                  })
+                : t("subscription.descriptionPastDue")
+            }
+            tone={sub.status === "canceled" ? "error" : "warning"}
+            action={
+              sub.portalAvailable ? (
+                <form action={openBillingPortal}>
+                  {/* variant="unstyled" + text-current/border-current, not variant="secondary" —
+                      a per-mode-fixed color fails contrast against the banner's warning/error
+                      fill in dark mode (design-review F4); size="big" for the 44px touch-target
+                      floor this is a mobile CTA under (design-review F5, Rule 14). */}
+                  <Button
+                    type="submit"
+                    variant="unstyled"
+                    size="big"
+                    className="rounded-control border-thin border-current bg-transparent px-control-x text-current hover:opacity-90 active:opacity-80"
+                  >
+                    {t("subscription.action")}
+                  </Button>
+                </form>
+              ) : undefined
+            }
+          />
+        ) : null}
+
         <section id="profile" className="flex flex-col gap-4" data-testid="account-profile">
           <Heading level={2}>{t("profile.heading")}</Heading>
           <DescriptionList

package/templates/apps/web/app/[locale]/(authed)/layout.tsx

@@ -50,5 +50,22 @@ export default async function AuthedLayout({
     );
   }
 
-  return <>{children}</>;
+  // data-profile="app" puts the Pro-host editor surfaces in this group on
+  // @working-theory/theme's app profile (#5953); tokens.css's own
+  // [data-profile="app"] header documents what it overrides. The div carries
+  // no className and no layout of its own — it exists only because this
+  // layout returns a fragment and the attribute needs an element.
+  //
+  // Two things about the placement are deliberate. Only the SIGNED-IN branch
+  // carries it: SignInGate above is the marketing site's sign-in front door,
+  // not an app surface. And the attribute goes on this nested div rather than
+  // the app's <html> because apps/web's marketing routes share that root and
+  // must stay on the marketing profile — which also makes this half immune to
+  // the `:root` shadowing the Admin host hit (different element, no
+  // specificity tie, so the app values apply and inherit down).
+  return (
+    <div data-profile="app" data-testid="authed-profile-root">
+      {children}
+    </div>
+  );
 }

package/templates/apps/web/app/[locale]/cancellation/page.tsx

@@ -0,0 +1,44 @@
+// CancellationPolicyPage route (#5947). Reads the CancellationPolicyPage MDX frontmatter, renders sections via
+// SectionRenderer, and emits a JSON-LD <script>.
+import type {
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections} from "@working-theory/page-renderer";
+import {
+  renderPage,
+  renderPageMetadata
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+}
+
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "CancellationPolicyPage", slug: "cancellation", locale });
+}
+
+export default async function Page({
+  params,
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  return renderPage({
+    type: "CancellationPolicyPage",
+    slug: "cancellation",
+    locale,
+    // Without a namespace `renderPage` 404s on a missing seed — and a scaffold
+    // IS a missing-seed environment, since `build-templates.mjs` snapshots
+    // `apps/` but deliberately not `content/`. The namespace makes this route
+    // render the #4154 authoring empty state at 200, exactly as /terms does.
+    translationsNamespace: "cancellation",
+    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(getPageSections !== undefined && { getPageSections }),
+  });
+}

package/templates/apps/web/app/[locale]/layout.tsx

@@ -4,6 +4,7 @@
 // Chrome extract — Nav + Footer from @working-theory/ui (#1451)
 // Shell/Chrome composition — Nav + Footer wrap via @working-theory/templates MarketingShell (#2820)
 // Session-aware Nav actions — Sign in / Account + Sign out from the server-read session (#4984)
+// Auth route group — the marketing chrome is dropped on the five (auth) paths (#5963)
 // Site-declared theme — `_site.mdx` `theme:` block → token overlay → CSS vars
 //
 // Sits under app/[locale]/ and sets the <html lang> attribute to the
@@ -48,6 +49,7 @@ import type { ReactElement, ReactNode } from "react";
 import { auth } from "../../auth";
 import { GoogleAnalytics } from "../../components/google-analytics";
 import { SignOutTrigger } from "../../components/sign-out-trigger";
+import { isAuthPath } from "../../lib/auth-routes";
 import { navItems } from "../../lib/nav-config";
 import { getOgImageUrl } from "../../lib/og";
 import { SITE_NAME, siteLogo } from "../../lib/site-brand";
@@ -320,6 +322,21 @@ export default async function LocaleLayout({
   const pathname = (await headers()).get("x-pathname") ?? homePath;
   const isDeckHome = siteChrome.home === "deck" && pathname === homePath;
 
+  // The (auth) route group's chrome branch (#5963).
+  //
+  // A route group's layout nests INSIDE its parent segment's layout, so
+  // `(auth)/layout.tsx` renders BETWEEN the Nav and the Footer below — a group
+  // changes which siblings share a layout, it does not let a child escape an
+  // ancestor. The only place the marketing frame can be dropped for those five
+  // paths is here, where it is composed.
+  //
+  // Fail-safe direction: `isAuthPath()` answers false for an absent
+  // `x-pathname`, so a missing header can never strip a marketing page's
+  // chrome; the worst case is an auth page rendered WITH chrome, which the
+  // group's own suite catches. The marketing tree is NOT restructured into a
+  // `(marketing)` group — a ~35-directory move for a five-page delta (spec D1).
+  const isAuthRoute = isAuthPath(pathname, enabledLocales);
+
   // Placeholder social handles + copyright (#5469 D5): `{{COMPANY_HANDLE}}` /
   // `{{COMPANY_NAME}}` are create-ailk markers substituted at scaffold time
   // (packages/create-ailk/src/programmatic.ts), so a customer's site never
@@ -420,94 +437,123 @@ export default async function LocaleLayout({
            * emitted unconditionally in OSS forks; paying customers install
            * @working-theory/branding and gate it in their own layout.
            */}
-          <MarketingShell
-            contentOwnsMain
-            gutters="plain"
-            bannerPlacement="above-nav"
-            {...(siteChrome.announcementBanner
-              ? {
-                  banner: (
-                    <Banner
-                      variant="contrast"
-                      placement="above-nav"
-                      message="Medium length banner heading with link goes here"
-                      action={{ label: "Link", href: "/pricing", kind: "link" }}
-                      routes={{ include: [homePath] }}
-                      dismissible={false}
-                      locale={locale}
+          {isAuthRoute ? (
+            /*
+             * The (auth) branch (#5963): the five auth paths render their own
+             * `(auth)/layout.tsx` — AuthShell — with no Nav and no marketing
+             * Footer above or below it. Everything outside this ternary (the
+             * document, the flash-prevention script, the theme vars, the
+             * favicons, NextIntlClientProvider, the consent Banner and
+             * Telemetry) is shared by both branches and written once.
+             */
+            children
+          ) : (
+            <MarketingShell
+              contentOwnsMain
+              gutters="plain"
+              bannerPlacement="above-nav"
+              {...(siteChrome.announcementBanner
+                ? {
+                    banner: (
+                      <Banner
+                        variant="contrast"
+                        placement="above-nav"
+                        message="Medium length banner heading with link goes here"
+                        action={{
+                          label: "Link",
+                          href: "/pricing",
+                          kind: "link",
+                        }}
+                        routes={{ include: [homePath] }}
+                        dismissible={false}
+                        locale={locale}
+                      />
+                    ),
+                  }
+                : {})}
+              {...(isDeckHome
+                ? { snap: "mandatory" as const, deckHero: true }
+                : {})}
+              nav={
+                <Nav
+                  locale={locale}
+                  labels={navLabels}
+                  navItems={siteChrome.nav === "mark-only" ? [] : navItems}
+                  // Deck home (#5697): the two forwards that join #5426 D4 to a
+                  // real deck. `sticky` pins the bar — MarketingShell renders
+                  // {nav} as a plain child of the scroll container, so under
+                  // `scroll-snap-type: y mandatory` the browser snaps slide 1 to
+                  // the top on load and the unpinned bar is gone before the
+                  // reader touches anything. `deckMorph` is what puts BrandLogo's
+                  // `.ailk-deck-brand-mark` / `.ailk-deck-brand-wordmark` hooks in
+                  // the document for the D4 CSS to key off; it requires both
+                  // `logo` and `wordmark` (Nav.tsx:344), which the layout already
+                  // passes above. Scoped to the SAME `isDeckHome` gate
+                  // MarketingShell's snap/deckHero use, so a non-deck route's
+                  // render is byte-identical to before this branch existed.
+                  {...(isDeckHome ? { sticky: true, deckMorph: true } : {})}
+                  siteName={SITE_NAME}
+                  showThemeToggle={false}
+                  logo={brandLogo}
+                  wordmark={brandWordmark}
+                  overflowLabel={navOverflowLabel}
+                  actions={navActions}
+                  {...(hasFlowAction
+                    ? {
+                        renderFlowTrigger: (action, trigger) =>
+                          action.labelKey === "signOut" ? (
+                            <SignOutTrigger>{trigger}</SignOutTrigger>
+                          ) : (
+                            <span
+                              className="text-body-sm text-(--color-text-muted)"
+                              data-testid="nav-account-name"
+                            >
+                              {navLabels.items.account}
+                            </span>
+                          ),
+                      }
+                    : {})}
+                />
+              }
+              footer={
+                <Footer
+                  locale={locale}
+                  itemLabels={navLabels.items}
+                  navItems={navItems}
+                  siteName={SITE_NAME}
+                  logo={brandLogo}
+                  social={[...socialLinks]}
+                  {...(siteChrome.footer === "centered"
+                    ? { layout: "centered" as const }
+                    : {})}
+                  showThemeToggle
+                  copyrightText={copyrightText}
+                  legalLinks={legalLinks}
+                  languageSwitcher={
+                    <LocaleSwitcherNav
+                      current={locale}
+                      locales={enabledLocales}
+                      pathname={pathname}
                     />
-                  ),
-                }
-              : {})}
-            {...(isDeckHome
-              ? { snap: "mandatory" as const, deckHero: true }
-              : {})}
-            nav={
-              <Nav
-                locale={locale}
-                labels={navLabels}
-                navItems={siteChrome.nav === "mark-only" ? [] : navItems}
-                siteName={SITE_NAME}
-                showThemeToggle={false}
-                logo={brandLogo}
-                wordmark={brandWordmark}
-                overflowLabel={navOverflowLabel}
-                actions={navActions}
-                {...(hasFlowAction
-                  ? {
-                      renderFlowTrigger: (action, trigger) =>
-                        action.labelKey === "signOut" ? (
-                          <SignOutTrigger>{trigger}</SignOutTrigger>
-                        ) : (
-                          <span
-                            className="text-body-sm text-(--color-text-muted)"
-                            data-testid="nav-account-name"
-                          >
-                            {navLabels.items.account}
-                          </span>
-                        ),
-                    }
-                  : {})}
-              />
-            }
-            footer={
-              <Footer
-                locale={locale}
-                itemLabels={navLabels.items}
-                navItems={navItems}
-                siteName={SITE_NAME}
-                logo={brandLogo}
-                social={[...socialLinks]}
-                {...(siteChrome.footer === "centered"
-                  ? { layout: "centered" as const }
-                  : {})}
-                showThemeToggle
-                copyrightText={copyrightText}
-                legalLinks={legalLinks}
-                languageSwitcher={
-                  <LocaleSwitcherNav
-                    current={locale}
-                    locales={enabledLocales}
-                    pathname={pathname}
-                  />
-                }
-                // #4157 — deliberately left as a literal "Built by Working
-                // Theory Labs" / https://ailaunchkit.ai, not SITE_NAME: this credits
-                // the OSS TEMPLATE this site is built with (a "powered by"
-                // link, unconditional in OSS forks per the comment above),
-                // never the customer's own identity, so it isn't the vendor-
-                // brand-as-default defect #4157 fixes. See
-                // docs/specs/4157-scaffold-brand-defaults-spec.md § Design
-                // Decisions for the fuller reasoning.
-                attribution={{
-                  label: "Built by Working Theory Labs",
-                  href: "https://ailaunchkit.ai",
-                }}
-              />
-            }
-          >
-            {children}
-          </MarketingShell>
+                  }
+                  // #4157 — deliberately left as a literal "Built by Working
+                  // Theory Labs" / https://ailaunchkit.ai, not SITE_NAME: this credits
+                  // the OSS TEMPLATE this site is built with (a "powered by"
+                  // link, unconditional in OSS forks per the comment above),
+                  // never the customer's own identity, so it isn't the vendor-
+                  // brand-as-default defect #4157 fixes. See
+                  // docs/specs/4157-scaffold-brand-defaults-spec.md § Design
+                  // Decisions for the fuller reasoning.
+                  attribution={{
+                    label: "Built by Working Theory Labs",
+                    href: "https://ailaunchkit.ai",
+                  }}
+                />
+              }
+            >
+              {children}
+            </MarketingShell>
+          )}
           {/*
            * Cookie consent (#5557). Bottom-pinned `info` Banner in consent
            * mode: `secondaryAction` makes Banner compose BannerConsentIsland,

package/templates/apps/web/app/[locale]/purchase/__tests__/cancel.test.tsx

@@ -0,0 +1,162 @@
+/**
+ * Tests for /[locale]/purchase/cancel (#6084).
+ *
+ * D4 — reads nothing. AC-2 — states nothing was charged, links to
+ * `/services`, noindex, every string from the `purchase` namespace.
+ */
+import React from "react";
+import { render } from "@testing-library/react";
+
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  notFound: jest.fn(() => {
+    throw new Error("NEXT_NOT_FOUND");
+  }),
+}));
+
+const requestedKeys: string[] = [];
+jest.mock("next-intl/server", () => ({
+  __esModule: true,
+  getTranslations: jest.fn().mockResolvedValue((key: string) => {
+    requestedKeys.push(key);
+    return `copy:${key}`;
+  }),
+}));
+
+const capturedSections: unknown[] = [];
+jest.mock("@working-theory/ui/sections", () => ({
+  __esModule: true,
+  SectionRenderer: ({ sections }: { sections: unknown[] }) => {
+    capturedSections.splice(0, capturedSections.length, ...sections);
+    return React.createElement("div", {
+      "data-testid": "section-renderer",
+      "data-section-count": String(sections.length),
+    });
+  },
+}));
+
+const mockGetSession = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  checkout: { getSession: (...args: unknown[]) => mockGetSession(...args) },
+}));
+
+// Mocks the REAL boundary `resolveCommerceClaim()` itself calls
+// (`checkLicense` from `@working-theory/license`), not the internal wrapper
+// module — matching the eslint "no internal-module mocks" rule (#507).
+const mockCheckLicense = jest.fn();
+jest.mock("@working-theory/license", () => ({
+  __esModule: true,
+  checkLicense: (...args: unknown[]) => mockCheckLicense(...args),
+}));
+
+// `../../../../src/lib/commerce-sections` wraps a lazy, webpack-ignored
+// `import()` of the paid `@working-theory/ui-commerce` package — mocked
+// directly, mirroring `../__tests__/success.test.tsx`'s identical mock.
+const mockEnsureCommerceSectionsRegistered = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- see the identical exception in success.test.tsx
+jest.mock("../../../../src/lib/commerce-sections", () => ({
+  __esModule: true,
+  ensureCommerceSectionsRegistered: () =>
+    mockEnsureCommerceSectionsRegistered(),
+}));
+
+import { notFound } from "next/navigation";
+
+import Page, { generateMetadata } from "../cancel/page";
+
+const mockNotFound = notFound as jest.MockedFunction<typeof notFound>;
+
+function sectionTypes(): string[] {
+  return capturedSections.map((s) => (s as { type: string }).type);
+}
+
+async function renderPage() {
+  const element = await Page({ params: Promise.resolve({ locale: "en" }) });
+  return render(element);
+}
+
+describe("/purchase/cancel", () => {
+  beforeEach(() => {
+    capturedSections.length = 0;
+    requestedKeys.length = 0;
+    mockGetSession.mockReset();
+    mockCheckLicense.mockReset();
+    mockCheckLicense.mockResolvedValue({ revoked: false, features: ["commerce"] });
+    mockNotFound.mockClear();
+    mockEnsureCommerceSectionsRegistered.mockReset();
+    mockEnsureCommerceSectionsRegistered.mockResolvedValue(true);
+  });
+
+  it("renders payment-receipt(outcome:cancel) → cta, with a primary link to /services (AC-2, D5)", async () => {
+    await renderPage();
+
+    expect(sectionTypes()).toEqual(["payment-receipt", "cta"]);
+    const receipt = capturedSections[0] as {
+      data: Record<string, unknown>;
+    };
+    expect(receipt.data.outcome).toBe("cancel");
+    const cta = capturedSections[1] as { data: Record<string, unknown> };
+    expect((cta.data.primaryCta as { href: string }).href).toBe("/services");
+  });
+
+  it("falls back to content-block instead of payment-receipt when @working-theory/ui-commerce is not installed", async () => {
+    mockEnsureCommerceSectionsRegistered.mockResolvedValue(false);
+
+    await renderPage();
+
+    expect(sectionTypes()).toEqual(["content-block", "cta"]);
+    const fallback = capturedSections[0] as {
+      data: { headline: string; body: string };
+    };
+    expect(fallback.data.headline).toBe("copy:cancel.title");
+    expect(fallback.data.body).toContain("copy:cancel.message");
+  });
+
+  it("reads NOTHING — no API call at all (D4)", async () => {
+    await renderPage();
+    expect(mockGetSession).not.toHaveBeenCalled();
+  });
+
+  it("takes every string from the purchase namespace (D4/AC-2)", async () => {
+    await renderPage();
+    expect(requestedKeys.length).toBeGreaterThan(0);
+    expect(requestedKeys.every((k) => k.startsWith("cancel."))).toBe(true);
+  });
+
+  it("is not indexable", async () => {
+    const metadata = await generateMetadata({
+      params: Promise.resolve({ locale: "en" }),
+    });
+    expect(metadata.robots).toEqual({ index: false, follow: true });
+  });
+
+  it("carries no data-outcome=success and no PaymentComplete string — a cancel is not a payment claim", async () => {
+    await renderPage();
+    const serialized = JSON.stringify(capturedSections);
+    expect(serialized).not.toContain('"outcome":"success"');
+    expect(serialized).not.toContain("PaymentComplete");
+  });
+
+  // ── T-16 / D12 — the request-time commerce-claim gate ───────────────────
+
+  it("answers notFound() when the commerce claim is NOT held (D12)", async () => {
+    mockCheckLicense.mockResolvedValue({ revoked: false, features: [] });
+
+    await expect(renderPage()).rejects.toThrow("NEXT_NOT_FOUND");
+    expect(mockNotFound).toHaveBeenCalledTimes(1);
+  });
+
+  it("fail-closed: answers notFound() when the licence read THROWS", async () => {
+    mockCheckLicense.mockRejectedValue(new Error("licence read blew up"));
+
+    await expect(renderPage()).rejects.toThrow();
+  });
+
+  it("renders normally when the commerce claim IS held", async () => {
+    mockCheckLicense.mockResolvedValue({ revoked: false, features: ["commerce"] });
+    await renderPage();
+    expect(mockNotFound).not.toHaveBeenCalled();
+    expect(sectionTypes()).toEqual(["payment-receipt", "cta"]);
+  });
+});