create-ailk 0.5.0 → 0.6.1

package/templates/apps/web/lib/__tests__/auth-email.test.ts

@@ -0,0 +1,214 @@
+/**
+ * @file auth-email.test.ts — Better Auth's three mail callbacks (#5962 § D3).
+ *
+ * Written before the implementation. The transport is INJECTED, so nothing
+ * here mocks an internal module and nothing here sends mail.
+ *
+ * What the suite pins, in the order the design depends on it:
+ *   - ONE serialization: the bytes that are signed are the bytes that are
+ *     sent. A key-order or whitespace drift between signer and sender is the
+ *     whole failure mode the raw-string seam exists to make impossible.
+ *   - the signature is HMAC-SHA256 over `<timestamp>.<body>`, so the
+ *     timestamp cannot be swapped independently of the body it authenticates.
+ *   - the credential-account check (§ D14): a user with no `credential`
+ *     account gets NO reset mail, and the suppression is silent — same return,
+ *     no throw, log-only. An OAuth-only user who completes a reset would
+ *     otherwise silently gain a password path around their IdP.
+ *   - the § D12 PII boundary on every log line: a userId, a kind, a reason and
+ *     an error KIND. Never the address, never the token, never the link.
+ *   - nothing throws. A failed notification must never fail the password
+ *     change it reports.
+ */
+
+import type { AuthEmailLog } from "../auth-email";
+import {
+  buildAuthEmailRequest,
+  makeSendResetPassword,
+  makeSendVerificationEmail,
+  makeSendPasswordChangedNotice,
+} from "../auth-email";
+
+const ORIGINAL_ENV = process.env;
+
+type LogLine = { level: string; fields: Record<string, unknown> };
+
+function makeLog(): { lines: LogLine[]; log: AuthEmailLog } {
+  const lines: LogLine[] = [];
+  const record =
+    (level: string) =>
+    (fields: Record<string, unknown>): void => {
+      lines.push({ level, fields });
+    };
+  return { lines, log: { warn: record("warn"), info: record("info") } };
+}
+
+/** A prisma double exposing only what these callbacks touch. */
+function makePrisma(hasCredential: boolean) {
+  return {
+    account: {
+      findFirst: jest.fn().mockResolvedValue(
+        hasCredential ? { id: "acct_1" } : null,
+      ),
+    },
+    verification: { deleteMany: jest.fn().mockResolvedValue({ count: 2 }) },
+  };
+}
+
+beforeEach(() => {
+  process.env = { ...ORIGINAL_ENV };
+  process.env.AUTH_EMAIL_WEBHOOK_SECRET = "webhook-secret";
+  process.env.AUTH_EMAIL_FROM = "noreply@site.example";
+  process.env.BETTER_AUTH_URL = "https://site.example";
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+describe("buildAuthEmailRequest()", () => {
+  it("signs the EXACT string it returns as the body", () => {
+    const req = buildAuthEmailRequest(
+      { kind: "password-reset", userId: "user_1", to: "a@b.test", url: "https://site.example/r" },
+      "webhook-secret",
+    );
+
+    const { createHmac } = require("node:crypto") as typeof import("node:crypto");
+    const timestamp = req.headers["x-ailk-auth-email-timestamp"];
+    const expected = `sha256=${createHmac("sha256", "webhook-secret")
+      .update(`${timestamp}.${req.rawBody}`, "utf8")
+      .digest("hex")}`;
+
+    expect(req.headers["x-ailk-auth-email-signature"]).toBe(expected);
+    // And the body really is a single string, not an object re-serialized later.
+    expect(typeof req.rawBody).toBe("string");
+    expect(JSON.parse(req.rawBody)).toMatchObject({
+      kind: "password-reset",
+      userId: "user_1",
+      to: "a@b.test",
+    });
+  });
+
+  it("puts a current unix-seconds timestamp inside the signed material", () => {
+    const req = buildAuthEmailRequest(
+      { kind: "password-changed", userId: "user_1", to: "a@b.test" },
+      "webhook-secret",
+    );
+    const ts = Number(req.headers["x-ailk-auth-email-timestamp"]);
+    expect(Math.abs(Math.floor(Date.now() / 1000) - ts)).toBeLessThan(5);
+  });
+});
+
+describe("sendResetPassword (§ D14 — the credential-account check)", () => {
+  it("sends for a user who HAS a credential account", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { lines, log } = makeLog();
+    const prisma = makePrisma(true);
+
+    const cb = makeSendResetPassword({ prisma, send, log });
+    await cb({ user: { id: "user_1", email: "person@example.com" }, url: "https://site.example/api/auth/reset-password/tok" });
+
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(lines.some((l) => l.fields.reason === "sent")).toBe(true);
+  });
+
+  it("sends NOTHING for a user with no credential account, and does not throw", async () => {
+    const send = jest.fn();
+    const { lines, log } = makeLog();
+    const prisma = makePrisma(false);
+
+    const cb = makeSendResetPassword({ prisma, send, log });
+    await expect(
+      cb({ user: { id: "user_1", email: "person@example.com" }, url: "https://site.example/x" }),
+    ).resolves.toBeUndefined();
+
+    expect(send).not.toHaveBeenCalled();
+    expect(lines.some((l) => l.fields.reason === "no_credential_account")).toBe(
+      true,
+    );
+  });
+
+  it("never throws when the transport fails", async () => {
+    const send = jest.fn().mockRejectedValue(new Error("network"));
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+
+    await expect(
+      cb({ user: { id: "user_1", email: "p@e.test" }, url: "https://site.example/x" }),
+    ).resolves.toBeUndefined();
+    expect(lines.some((l) => l.fields.reason === "send_failed")).toBe(true);
+  });
+
+  it("logs nothing when the relay secret is absent — it does not send blind", async () => {
+    delete process.env.AUTH_EMAIL_WEBHOOK_SECRET;
+    const send = jest.fn();
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+
+    await cb({ user: { id: "user_1", email: "p@e.test" }, url: "https://site.example/x" });
+    expect(send).not.toHaveBeenCalled();
+    expect(lines.some((l) => l.fields.reason === "not_configured")).toBe(true);
+  });
+});
+
+describe("the § D12 PII boundary", () => {
+  it("never logs the address, the token or the assembled link", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { lines, log } = makeLog();
+    const url =
+      "https://site.example/api/auth/reset-password/SECRETTOKEN?callbackURL=%2Freset-password";
+
+    const reset = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+    await reset({ user: { id: "user_1", email: "person@example.com" }, url });
+
+    const verify = makeSendVerificationEmail({ send, log });
+    await verify({ user: { id: "user_1", email: "person@example.com" }, url });
+
+    const notice = makeSendPasswordChangedNotice({ send, log });
+    await notice({ id: "user_1", email: "person@example.com" });
+
+    const serialized = JSON.stringify(lines);
+    expect(serialized).not.toContain("person@example.com");
+    expect(serialized).not.toContain("SECRETTOKEN");
+    expect(serialized).not.toContain("site.example");
+    // What it DOES carry.
+    expect(serialized).toContain("user_1");
+    expect(serialized).toContain("password-reset");
+  });
+
+  it("carries only the tagged error KIND, never a message that can quote an address", async () => {
+    const send = jest.fn().mockResolvedValue({
+      ok: false,
+      status: 400,
+      body: { error: "validation_failed for person@example.com" },
+    });
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+
+    await cb({ user: { id: "user_1", email: "person@example.com" }, url: "https://site.example/x" });
+    expect(JSON.stringify(lines)).not.toContain("person@example.com");
+  });
+});
+
+describe("makeSendPasswordChangedNotice (§ D17)", () => {
+  it("sends a password-changed body carrying no url", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { log } = makeLog();
+    const notice = makeSendPasswordChangedNotice({ send, log });
+
+    await notice({ id: "user_1", email: "person@example.com" });
+
+    const [rawBody] = send.mock.calls[0];
+    const parsed = JSON.parse(rawBody);
+    expect(parsed.kind).toBe("password-changed");
+    expect(parsed).not.toHaveProperty("url");
+  });
+
+  it("never throws — a failed notice must not fail the password change", async () => {
+    const send = jest.fn().mockRejectedValue(new Error("down"));
+    const { log } = makeLog();
+    const notice = makeSendPasswordChangedNotice({ send, log });
+    await expect(
+      notice({ id: "user_1", email: "person@example.com" }),
+    ).resolves.toBeUndefined();
+  });
+});

package/templates/apps/web/lib/__tests__/auth-routes.test.ts

@@ -0,0 +1,74 @@
+/**
+ * Tests for the auth-route predicate (#5963).
+ *
+ * `isAuthPath()` is the ONE list the locale layout branches on and the five
+ * `(auth)` page segments are named from, so the layout and the routes cannot
+ * drift. Covers bare paths, locale-prefixed paths, near misses, nested paths,
+ * and the absent-header fail-safe.
+ */
+
+import { AUTH_SEGMENTS, isAuthPath } from "../auth-routes";
+
+const LOCALES = ["en", "fr", "de"];
+
+describe("AUTH_SEGMENTS", () => {
+  it("names exactly the five auth routes", () => {
+    expect([...AUTH_SEGMENTS]).toEqual([
+      "sign-in",
+      "sign-up",
+      "forgot-password",
+      "reset-password",
+      "verify-email",
+    ]);
+  });
+});
+
+describe("isAuthPath", () => {
+  it.each(AUTH_SEGMENTS)("matches the bare /%s path", (segment) => {
+    expect(isAuthPath(`/${segment}`, LOCALES)).toBe(true);
+  });
+
+  it.each(AUTH_SEGMENTS)("matches the locale-prefixed /fr/%s path", (segment) => {
+    expect(isAuthPath(`/fr/${segment}`, LOCALES)).toBe(true);
+  });
+
+  it("matches a trailing-slash auth path", () => {
+    expect(isAuthPath("/sign-in/", LOCALES)).toBe(true);
+  });
+
+  it("matches an auth path carrying a query string", () => {
+    expect(isAuthPath("/sign-in?next=/account", LOCALES)).toBe(true);
+  });
+
+  it("matches a nested path under an auth segment", () => {
+    expect(isAuthPath("/reset-password/confirm", LOCALES)).toBe(true);
+  });
+
+  it("does not match a near miss", () => {
+    expect(isAuthPath("/sign-in-x", LOCALES)).toBe(false);
+    expect(isAuthPath("/sign", LOCALES)).toBe(false);
+  });
+
+  it("does not match a marketing path", () => {
+    expect(isAuthPath("/pricing", LOCALES)).toBe(false);
+    expect(isAuthPath("/fr/pricing", LOCALES)).toBe(false);
+  });
+
+  it("does not match the locale root or the site root", () => {
+    expect(isAuthPath("/", LOCALES)).toBe(false);
+    expect(isAuthPath("/fr", LOCALES)).toBe(false);
+  });
+
+  it("does not strip a prefix that is not an enabled locale", () => {
+    // `/es` is not enabled here, so `es` is the first segment, not a prefix.
+    expect(isAuthPath("/es/sign-in", LOCALES)).toBe(false);
+  });
+
+  it("fails to NOT-an-auth-path for an empty or absent pathname", () => {
+    // The fail-safe direction (§ D1): an absent `x-pathname` must never strip
+    // a marketing page's chrome. The worst case is an auth page WITH chrome,
+    // which the (auth) group's own tests catch.
+    expect(isAuthPath("", LOCALES)).toBe(false);
+    expect(isAuthPath(undefined, LOCALES)).toBe(false);
+  });
+});

package/templates/apps/web/lib/__tests__/meeting-slugs.test.ts

@@ -0,0 +1,72 @@
+// oss: false
+/**
+ * Tests for enabledMeetingSlugs (#6183 S9b D5) — the D4-resolving read both
+ * /meet pages share.
+ */
+const mockMeetingTypes = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  schedule: { meetingTypes: (...args: unknown[]) => mockMeetingTypes(...args) },
+}));
+
+import { enabledMeetingSlugs } from "../meeting-slugs";
+
+describe("enabledMeetingSlugs", () => {
+  const originalEnv = process.env["SCHEDULING_CAL_LINK"];
+
+  beforeEach(() => {
+    mockMeetingTypes.mockReset();
+  });
+
+  afterEach(() => {
+    if (originalEnv === undefined) delete process.env["SCHEDULING_CAL_LINK"];
+    else process.env["SCHEDULING_CAL_LINK"] = originalEnv;
+  });
+
+  it("passes a real, populated array through unchanged", async () => {
+    mockMeetingTypes.mockResolvedValue({
+      ok: true,
+      body: { slugs: ["intro", "demo"] },
+    });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual(["intro", "demo"]);
+  });
+
+  it("passes a real, intentionally empty array through unchanged (D4 row 2 — never the fallback)", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: [] } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+
+  it("null + SCHEDULING_CAL_LINK set → the derived singleton (D4 row 1)", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual(["intro-call"]);
+  });
+
+  it("null + SCHEDULING_CAL_LINK unset → [] (no shipped page to protect)", async () => {
+    delete process.env["SCHEDULING_CAL_LINK"];
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+
+  it("a non-ok API result → [], fail closed — an outage must not open the gate", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: false, status: 500, body: null });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+
+  it("null + a MALFORMED SCHEDULING_CAL_LINK slug → [], never a corrupt fallback (D14 parity, security review 2026-09-19)", async () => {
+    // A comma in the derived slug would corrupt the batched event-meta
+    // `calLinks` join downstream (it splits on comma), misattributing the
+    // rest of the list to a foreign owner — MeetingSlugSchema rejects it.
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro,evil";
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+});

package/templates/apps/web/lib/__tests__/site-theme.test.ts

@@ -4,11 +4,28 @@
  * This is the end-to-end claim the wiring makes — a site declares a theme and
  * the built page renders in those colours — asserted on the actual repo file
  * rather than a fixture, so deleting the `theme:` block would fail here.
+ *
+ * Every expectation is DERIVED from whichever `_site.mdx` the test reads, never
+ * hard-coded (#6460). This file is snapshotted into `create-ailk`'s
+ * `templates/`, so it runs against TWO different `_site.mdx` files: this
+ * monorepo's, and the scaffold's own. Hard-coded values made it a snapshot of
+ * one tree's palette masquerading as a round-trip test — green here, red in a
+ * scaffold whose theme differs, which is exactly what happened when the base
+ * scaffold moved to the black-on-white foundation. It also meant a CUSTOMER who
+ * took the file's own invitation to "declare only what you change" got a red
+ * suite for editing their own colours.
+ *
+ * Deriving keeps every claim the hard-coded form made — the mapping is applied,
+ * the values reach the CSS, and nothing else moves — while making all three
+ * true of any declared palette. Deleting the `theme:` block still fails, on the
+ * `toBeDefined()` below.
  */
-import { mkdtempSync, writeFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
+import { parse as parseYaml } from "yaml";
+
 import { PartialColorPaletteSchema } from "@working-theory/site-config/schema";
 import { siteColorTokenMap, themeToCssVarsBothModes } from "@working-theory/theme";
 
@@ -26,6 +43,46 @@ function darkBlock(css: string): string {
   return css.slice(css.indexOf(':root[data-theme="dark"]'));
 }
 
+/** The two modes, as the palette and the emitted CSS both name them. */
+const MODES = ["light", "dark"] as const;
+
+/**
+ * The `theme.colors` block exactly as the `_site.mdx` under test declares it —
+ * raw SLOT names (`text`, `primary`), not token keys. Read with the same
+ * frontmatter parse `site-theme.ts` uses, so the test cannot pass against a
+ * file the implementation reads differently.
+ */
+function declaredColors(): Partial<Record<(typeof MODES)[number], Record<string, string>>> {
+  const raw = readFileSync(join(REPO_CONTENT_ROOT, "_site.mdx"), "utf8");
+  const frontmatter = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
+  const parsed = parseYaml(frontmatter?.[1] ?? "") as
+    | { theme?: { colors?: Record<string, Record<string, string>> } }
+    | null;
+  return parsed?.theme?.colors ?? {};
+}
+
+/**
+ * The CSS custom property a token key is emitted as — `fgOnBrand` →
+ * `--color-fg-on-brand`. The colon in every call site anchors the match, so
+ * `--color-surface` never collides with `--color-surface-secondary`.
+ */
+function cssVar(tokenKey: string): string {
+  return `--color-${tokenKey.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)}`;
+}
+
+/** `{ [tokenKey]: value }` for one mode's declared slots, mapping applied. */
+function declaredTokens(mode: (typeof MODES)[number]): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [slot, value] of Object.entries(declaredColors()[mode] ?? {})) {
+    const tokenKey = siteColorTokenMap[slot as keyof typeof siteColorTokenMap];
+    // A slot with no token counterpart cannot reach the CSS at all —
+    // `siteThemeToBrandTokens` throws on it, which the schema's own tests
+    // cover. Nothing to assert about it here.
+    if (typeof tokenKey === "string") out[tokenKey] = value;
+  }
+  return out;
+}
+
 describe("loadSiteBrandTokens — the real content/_site.mdx", () => {
   const originalRoot = process.env.AILK_CONTENT_ROOT;
 
@@ -38,35 +95,93 @@ describe("loadSiteBrandTokens — the real content/_site.mdx", () => {
     else process.env.AILK_CONTENT_ROOT = originalRoot;
   });
 
-  it("translates the declared theme into the token overlay", () => {
-    expect(loadSiteBrandTokens()).toEqual({
-      colors: {
-        light: { bg: "#fdfcfa", fg: "#1c1917" },
-        dark: { bg: "#0c0a09" },
-      },
-    });
+  it("translates every colour the file declares into its mapped token", () => {
+    const overlay = loadSiteBrandTokens();
+    // The `theme:` block exists and produced an overlay — the claim the
+    // hard-coded form made by naming values, kept without naming them.
+    expect(overlay).toBeDefined();
+
+    // `BrandTokenOverrides` is deliberately `Readonly<Record<string, unknown>>`
+    // — `@working-theory/theme` cannot name the overlay's shape without
+    // pinning it to one token set — so the test states the shape it asserts
+    // about. The hard-coded form sidestepped this by comparing whole objects.
+    const colors = (overlay?.["colors"] ?? {}) as Partial<
+      Record<(typeof MODES)[number], Record<string, string>>
+    >;
+
+    let asserted = 0;
+    for (const mode of MODES) {
+      const expectedTokens = declaredTokens(mode);
+      // Exactly the declared slots, nothing invented and nothing dropped.
+      expect(colors[mode] ?? {}).toEqual(expectedTokens);
+      asserted += Object.keys(expectedTokens).length;
+    }
+    // Non-vacuity: a file that declared nothing would satisfy the loop above.
+    expect(asserted).toBeGreaterThan(0);
   });
 
   it("reaches the emitted CSS custom properties", () => {
     const brand = loadSiteBrandTokens();
     const css = themeToCssVarsBothModes(brand ? { brand } : {});
-
-    expect(lightBlock(css)).toContain("--color-bg: #fdfcfa;");
-    expect(lightBlock(css)).toContain("--color-fg: #1c1917;");
-    expect(darkBlock(css)).toContain("--color-bg: #0c0a09;");
+    const blockFor = { light: lightBlock(css), dark: darkBlock(css) };
+
+    let asserted = 0;
+    for (const mode of MODES) {
+      for (const [tokenKey, value] of Object.entries(declaredTokens(mode))) {
+        expect(blockFor[mode]).toContain(`${cssVar(tokenKey)}: ${value};`);
+        asserted += 1;
+      }
+    }
+    expect(asserted).toBeGreaterThan(0);
   });
 
   it("changes exactly the declared variables and nothing else", () => {
     const brand = loadSiteBrandTokens();
     const themed = themeToCssVarsBothModes(brand ? { brand } : {});
-    const expected = themeToCssVarsBothModes()
-      // light block — the two declared light colours
-      .replace("--color-bg: #ffffff;", "--color-bg: #fdfcfa;")
-      .replace("--color-fg: #030712;", "--color-fg: #1c1917;")
-      // dark block — the one declared dark colour
-      .replace("--color-bg: #0a0a0a;", "--color-bg: #0c0a09;");
-
-    expect(themed).toBe(expected);
+
+    // Rebuild the expectation from the DEFAULT CSS by overwriting, per mode
+    // block, only the variables this site declares. Anything the overlay
+    // touched beyond them makes the final equality fail — which is the whole
+    // point of this case.
+    const base = themeToCssVarsBothModes();
+    const rewritten = { light: lightBlock(base), dark: darkBlock(base) };
+    for (const mode of MODES) {
+      for (const [tokenKey, value] of Object.entries(declaredTokens(mode))) {
+        const pattern = new RegExp(`(${cssVar(tokenKey)}: )[^;]+;`);
+        // The variable must exist in the default block for the overwrite to
+        // mean anything — a replace with no target would weaken the equality
+        // below into a tautology. Presence is the right check rather than
+        // "the text changed": a site may legitimately declare a value that
+        // already MATCHES the default (the black-on-white base declares
+        // `bg: #ffffff`, which light mode already is), and that no-op is
+        // correct, not vacuous.
+        expect(rewritten[mode]).toMatch(pattern);
+        rewritten[mode] = rewritten[mode].replace(pattern, `$1${value};`);
+      }
+
+      // `--color-surface-raised` is DERIVED, not independent: the emitter
+      // resolves it from `surfaceSecondary` in light mode and from `surface`
+      // in dark (`packages/theme/src/theme-to-css.ts`, and the rule is
+      // documented at `site-theme.ts`'s header). So a site that declares
+      // either of those moves it too, and the equality below has to account
+      // for it — re-derived here from whatever the block now carries rather
+      // than restated as a value, so the two cannot drift.
+      //
+      // Kept inside the total equality instead of excluded from it: this
+      // variable is SUPPOSED to move, and excluding it would stop the test
+      // noticing if it ever stopped moving.
+      const derivedFrom = mode === "light" ? "surfaceSecondary" : "surface";
+      const sourceValue = new RegExp(`${cssVar(derivedFrom)}: ([^;]+);`).exec(
+        rewritten[mode],
+      )?.[1];
+      expect(sourceValue).toBeDefined();
+      rewritten[mode] = rewritten[mode].replace(
+        /(--color-surface-raised: )[^;]+;/,
+        `$1${sourceValue};`,
+      );
+    }
+
+    expect(themed).toBe(rewritten.light + rewritten.dark);
   });
 
   it("treats a bare `theme:` key as no theme, rather than throwing", () => {

package/templates/apps/web/lib/__tests__/structured-data.test.tsx

@@ -311,7 +311,24 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
     subtree: true,
   },
   { route: "meet", reason: "booking surface, API-backed", subtree: true },
-  { route: "sign-in", reason: "auth surface, not a content page" },
+  // #6084 — both purchase return pages read a Checkout Session (or read
+  // nothing, for cancel) and render via SectionRenderer directly; neither
+  // is a content-adapter page, and the paid render's own schema.org node
+  // (`PaymentComplete`, D6) is asserted directly, not through this walk.
+  {
+    route: "purchase",
+    reason: "checkout return pages, API-backed / read-nothing",
+    subtree: true,
+  },
+  // The whole (auth) route group (#5963). The walk keys on the DIRECTORY
+  // path, and a route group's parens are part of it, so this one subtree
+  // entry covers all five auth pages — including /sign-in, whose own entry it
+  // replaces now that the page sits inside the group.
+  {
+    route: "(auth)",
+    reason: "auth surfaces, not content pages",
+    subtree: true,
+  },
 ];
 
 interface RouteEntry {