create-ailk 0.7.0 → 0.9.0

package/templates/apps/api/src/services/revalidation.ts

@@ -3,30 +3,48 @@
  * @description The signed webhook `apps/api` fires at the site's
  * `/api/revalidate` on publish and unpublish (#5851, roadmap D6). One POST of
  * `{ workspaceId, type, slug, locale }` to `CONTENT_REVALIDATE_URL`, signed
- * HMAC-SHA256 over the exact body bytes with `CONTENT_REVALIDATE_SECRET`.
+ * HMAC-SHA256 with `CONTENT_REVALIDATE_SECRET` over the base string
+ * `v0:{timestamp}:{event}:{body}` (#5902) — the Slack shape
+ * (`routes/slack/actions.ts:56`) with the event folded in, so neither a replay
+ * outside the receiver's 5-minute window nor an in-flight event flip verifies.
+ *
+ * `type`, `slug` and `locale` are validated against bounded Zod shapes FIRST,
+ * before the config check and before any outbound call; an invalid value
+ * throws. That is the one way this function rejects, and it is a programmer
+ * error rather than a delivery failure: the publish routes already hold these
+ * values to the same shapes.
  *
  * Either var absent means "revalidation off": one `warn` and return. Both set
  * means three bounded attempts (500 ms then 2000 ms backoff, 10 s per-attempt
  * timeout — 32.5 s worst case), every attempt logged, and a final failure
- * LOGGED rather than thrown. `notifyRevalidate` never rejects, which is what
- * lets the publish path `await` it and still always complete.
+ * LOGGED rather than thrown. Delivery never rejects, which is what lets the
+ * publish path `await` it and still always complete.
  *
  * PII boundary: log lines carry only
  * `{ event, workspaceId, type, slug, locale, attempt/attempts, status/lastStatus, errName }`.
  * Never the secret, never the signature, never a response body, never page
  * content.
  *
- * Nothing calls this yet — the publish/unpublish handlers are a sibling child
- * of Epic #5323, and the receiver is Epic #5324. This module fixes the wire
- * contract a receiver implements: method POST; the four-key JSON body;
- * headers `content-type: application/json`, `x-ailk-revalidate-signature:
- * sha256=<lowercase hex>` and `x-ailk-revalidate-event: publish | unpublish`.
- * A receiver verifies by recomputing the HMAC over the RAW request body and
- * comparing in constant time.
+ * The publish and unpublish handlers in `routes/workspaces/content.ts` call
+ * this; the receiver is `apps/web/app/api/revalidate/route.ts`. This module
+ * fixes the wire contract that receiver implements: method POST; the four-key
+ * JSON body; headers `content-type: application/json`,
+ * `x-ailk-revalidate-timestamp: <unix seconds>`,
+ * `x-ailk-revalidate-event: publish | unpublish` and
+ * `x-ailk-revalidate-signature: sha256=<lowercase hex>`. A receiver rejects a
+ * timestamp more than 5 minutes from its own clock, then recomputes the HMAC
+ * over `v0:{timestamp}:{event}:` + the RAW request body and compares in
+ * constant time.
  */
 import { createHmac } from "node:crypto";
 
+import {
+  SCHEMA_ORG_TYPES,
+  SLUG_PATTERN,
+} from "@working-theory/content-adapters";
 import { createLogger } from "@working-theory/observability";
+import { localeSchema } from "@working-theory/validation";
+import { z } from "zod";
 
 import { config } from "../config/index.js";
 import { outboundFetch } from "../lib/outbound-http.js";
@@ -35,6 +53,22 @@ const log = createLogger({ service: "revalidation" });
 
 const SIGNATURE_HEADER = "x-ailk-revalidate-signature";
 const EVENT_HEADER = "x-ailk-revalidate-event";
+const TIMESTAMP_HEADER = "x-ailk-revalidate-timestamp";
+
+/**
+ * The bounds on the three fields that become the site's cache tags
+ * (`content:{workspace}:{type}:{slug}:{locale}`). `type` and `slug` are exactly
+ * the content routes' `addressParamsSchema` shapes and `locale` is the BCP-47
+ * subset `resolveLocale` produces, so the publish path can never trip this
+ * after its write has committed. None admits a `:`, which is what stops a
+ * crafted `type` colliding with another page's tag (#6005 M3); the receiver
+ * applies the same shapes.
+ */
+const targetFieldsSchema = z.object({
+  type: z.enum(SCHEMA_ORG_TYPES),
+  slug: z.string().regex(SLUG_PATTERN),
+  locale: localeSchema,
+});
 
 /**
  * Backoff before attempt 2 and attempt 3. Three attempts total, no fourth:
@@ -69,14 +103,21 @@ function isRetryableStatus(status: number): boolean {
 }
 
 /**
- * Tells the site to revalidate one piece of content. Resolves in every case —
- * success, exhausted retries, or unconfigured — so an `await` in the publish
- * path can never fail the publish it follows.
+ * Tells the site to revalidate one piece of content. Resolves on success,
+ * exhausted retries, or unconfigured, so an `await` in the publish path cannot
+ * fail the publish it follows. Rejects only when `type`, `slug` or `locale` is
+ * out of bounds, before anything is signed or sent.
  */
 export async function notifyRevalidate(
   target: RevalidateTarget,
   options: RevalidateOptions,
 ): Promise<void> {
+  targetFieldsSchema.parse({
+    type: target.type,
+    slug: target.slug,
+    locale: target.locale,
+  });
+
   const url = config.CONTENT_REVALIDATE_URL;
   const secret = config.CONTENT_REVALIDATE_SECRET;
 
@@ -100,8 +141,11 @@ export async function notifyRevalidate(
     slug: target.slug,
     locale: target.locale,
   });
+  // Taken once per call and shared by every attempt: the retry schedule's
+  // 32.5 s worst case sits well inside the receiver's 5-minute tolerance.
+  const timestamp = String(Math.floor(Date.now() / 1000));
   const signature = createHmac("sha256", secret)
-    .update(body, "utf8")
+    .update(`v0:${timestamp}:${options.event}:${body}`, "utf8")
     .digest("hex");
 
   let attempt = 0;
@@ -117,8 +161,9 @@ export async function notifyRevalidate(
         method: "POST",
         headers: {
           "content-type": "application/json",
-          [SIGNATURE_HEADER]: `sha256=${signature}`,
+          [TIMESTAMP_HEADER]: timestamp,
           [EVENT_HEADER]: options.event,
+          [SIGNATURE_HEADER]: `sha256=${signature}`,
         },
         body,
         // The SSRF gate is waived deliberately and narrowly: this URL comes

package/templates/apps/mcp/__tests__/parity.test.ts

@@ -103,7 +103,6 @@ const MCP_ONLY_TOOLS = new Set([
   "ailkGetPricing", // get_pricing — pure read, no action equivalent (I4)
   "ailkGetFaq", // get_faq — pure read, no action equivalent (I4)
   "ailkAudit", // audit — AEO scoring tool, no web action equivalent (I5; ADR 0013)
-  "ailkSubscribeNewsletter", // subscribe_newsletter — anonymous write via MCP; no Server Action (B7)
   "ailkRequestCallback", // request_callback — anonymous write via MCP; no Server Action (B7)
   "ailkCreateProject", // create_project — agent-only project creator; no Server Action equivalent (#299)
   "ailkGetFlow", // get_flow — agent-callable flow-engine read; no web Server Action (#3956 D7)
@@ -228,6 +227,8 @@ describe("MCP ↔ Server-Action parity (filesystem)", () => {
     // ailkSubmitFlowStep): twenty tools + three paired Server Actions.
     // - ailkPurchase: paired with purchaseAction (apps/web/app/dev/purchase/).
     // - ailkCaptureLead: paired with captureLeadAction (apps/web/app/contact/).
+    // - ailkSubscribeNewsletter: paired with subscribeNewsletterAction
+    //   (apps/web/app/[locale]/newsletter/newsletter.actions.ts, #6730 D9).
     // - ailkSubmitFlowStep: paired with submitFlowStepAction
     //   (apps/web/app/[locale]/flows/[slug]/flow.actions.ts, #3957).
     // - startCheckoutAction, saveRecommendationAction: WEB-ONLY (#4842 D7,
@@ -241,8 +242,8 @@ describe("MCP ↔ Server-Action parity (filesystem)", () => {
     //   ailkGetLocations, ailkGetOfferings, ailkGetPricing, ailkGetFaq:
     //   MCP-only (pure read; I4; in MCP_ONLY_TOOLS allow-list).
     // - ailkAudit: MCP-only (AEO scoring; I5; in MCP_ONLY_TOOLS allow-list).
-    // - ailkSubscribeNewsletter, ailkRequestCallback:
-    //   MCP-only anonymous-write tools (B7; in MCP_ONLY_TOOLS allow-list).
+    // - ailkRequestCallback: MCP-only anonymous-write tool (B7; in
+    //   MCP_ONLY_TOOLS allow-list).
     // - ailkCreateProject: MCP-only agent project creator (#299; in MCP_ONLY_TOOLS).
     // - ailkCreatePage, ailkUpdatePage, ailkDeletePage: RETIRED by #5853
     //   (D7). Their HTTP twins — the untenanted /v1/content writes — were
@@ -264,7 +265,7 @@ describe("MCP ↔ Server-Action parity (filesystem)", () => {
     // - ailkGetEventMeta: MCP-only meta-only scheduling read, twin of
     //   GET /v1/schedule/event-meta (#4633) — same posture as the other
     //   scheduling tools.
-    expect(actions.size).toBe(5);
+    expect(actions.size).toBe(6);
     expect(tools.size).toBe(20);
     expect(r.missingTools).toEqual([]);
     expect(r.orphanTools).toEqual([]);

package/templates/apps/mcp/__tests__/tools/create_project.test.ts

@@ -102,6 +102,30 @@ describe("scaffoldOutputSchema", () => {
 // __tests__/tools → __tests__ → apps/mcp → apps → repo root
 const REPO_ROOT = resolve(__dirname, "../../../..");
 const CLI_PATH = join(REPO_ROOT, "packages/create-ailk/dist/cli.js");
+// NO_HAND_IMPLEMENT_OK: trunk fix for a red main (CI run 36386534464), operator-attended session.
+// The CLI substitutes `workspace:*` versions from create-ailk's gitignored
+// `versions.json`, which only `build-templates` writes ("empty before the first
+// build"); with it absent every scaffold throws "no version found for …".
+// Turbo gives this package's test no dependency on create-ailk's build-templates
+// step, so whether the file exists here depends on shard packing. Every case
+// that runs the CLI therefore skips — with a warning, never a failure — until
+// both the CLI and its version map are on disk.
+const VERSIONS_PATH = join(REPO_ROOT, "packages/create-ailk/versions.json");
+
+/** True (after warning) when the CLI cannot scaffold in this checkout yet. */
+function skipUnlessCliReady(): boolean {
+  if (!existsSync(CLI_PATH)) {
+    console.warn("[create_project.test] skipping integration test — CLI not built");
+    return true;
+  }
+  if (!existsSync(VERSIONS_PATH)) {
+    console.warn(
+      "[create_project.test] skipping integration test — run `pnpm --filter create-ailk run build-templates` first",
+    );
+    return true;
+  }
+  return false;
+}
 
 describe("ailkCreateProject handler", () => {
   let scratch: string;
@@ -124,10 +148,7 @@ describe("ailkCreateProject handler", () => {
   });
 
   it("scaffolds at least one file into a fresh tmp dir and reports targetDir", async () => {
-    if (!existsSync(CLI_PATH)) {
-      console.warn("[create_project.test] skipping integration test — CLI not built");
-      return;
-    }
+    if (skipUnlessCliReady()) return;
     const target = join(scratch, "my-site");
     const output = await ailkCreateProject(
       { targetDir: target, projectName: "my-site" },
@@ -138,10 +159,7 @@ describe("ailkCreateProject handler", () => {
   });
 
   it("scaffolds package.json when full templates are built (build-templates required)", async () => {
-    if (!existsSync(CLI_PATH)) {
-      console.warn("[create_project.test] skipping integration test — CLI not built");
-      return;
-    }
+    if (skipUnlessCliReady()) return;
     const TEMPLATES_DIR = join(REPO_ROOT, "packages/create-ailk/templates");
     const PKG_JSON_IN_TEMPLATES = join(TEMPLATES_DIR, "package.json");
     if (!existsSync(PKG_JSON_IN_TEMPLATES)) {
@@ -156,10 +174,7 @@ describe("ailkCreateProject handler", () => {
   });
 
   it("scaffolds app dir when full templates are built (build-templates required)", async () => {
-    if (!existsSync(CLI_PATH)) {
-      console.warn("[create_project.test] skipping integration test — CLI not built");
-      return;
-    }
+    if (skipUnlessCliReady()) return;
     const TEMPLATES_DIR = join(REPO_ROOT, "packages/create-ailk/templates");
     const PKG_JSON_IN_TEMPLATES = join(TEMPLATES_DIR, "package.json");
     if (!existsSync(PKG_JSON_IN_TEMPLATES)) {
@@ -178,10 +193,7 @@ describe("ailkCreateProject handler", () => {
   });
 
   it("returns at least one file (schema-typed page seed or README.md)", async () => {
-    if (!existsSync(CLI_PATH)) {
-      console.warn("[create_project.test] skipping integration test — CLI not built");
-      return;
-    }
+    if (skipUnlessCliReady()) return;
     const target = join(scratch, "my-site");
     await ailkCreateProject({ targetDir: target, projectName: "my-site" }, CLI_PATH);
     // At minimum README.md is always emitted by the template.
@@ -189,10 +201,7 @@ describe("ailkCreateProject handler", () => {
   });
 
   it("returns output conforming to scaffoldOutputSchema", async () => {
-    if (!existsSync(CLI_PATH)) {
-      console.warn("[create_project.test] skipping integration test — CLI not built");
-      return;
-    }
+    if (skipUnlessCliReady()) return;
     const target = join(scratch, "my-site");
     const output = await ailkCreateProject(
       { targetDir: target, projectName: "my-site" },
@@ -203,10 +212,7 @@ describe("ailkCreateProject handler", () => {
   });
 
   it("rejects with a clear error when targetDir is non-empty", async () => {
-    if (!existsSync(CLI_PATH)) {
-      console.warn("[create_project.test] skipping integration test — CLI not built");
-      return;
-    }
+    if (skipUnlessCliReady()) return;
     const target = join(scratch, "populated");
     mkdirSync(target);
     writeFileSync(join(target, "existing.txt"), "data");

package/templates/apps/mcp/src/tools/create_project.ts

@@ -16,6 +16,12 @@
  * correctly in production and in integration tests.
  *
  * Input:  { targetDir, projectName, preset? }
+ *   The tool builds the Free organization-product starter (`--shape
+ *   organization-product`, #6754 D9); `preset` stays reserved. Always builds
+ *   the Free module set (`--modules marketing`, #6759 D6, SEC-7): a licence
+ *   key sitting in the MCP server's own environment never widens what an
+ *   anonymous caller receives — the explicit keep list takes precedence over
+ *   any key-derived level probe before the child process reads its env.
  *   targetDir   — absolute or relative path to scaffold into; must not exist
  *                 or must be empty (enforced by create-ailk ValidationError)
  *   projectName — project name used in README and package.json
@@ -94,12 +100,21 @@ export async function ailkCreateProject(
   const targetAbs = resolve(input.targetDir);
 
   // Spawn the CLI synchronously — no network, no async I/O needed.
-  // Hard-coded node invocation; only targetDir flows through user input.
-  const result = spawnSync("node", [bin, targetAbs], {
-    stdio: ["ignore", "pipe", "pipe"],
-    shell: false,
-    encoding: "utf8",
-  });
+  // Hard-coded node invocation; only targetDir flows through user input. The
+  // CLI refuses a run naming no shape and no template, so the tool names one.
+  // `--modules marketing` is pinned explicitly (#6759 D6, SEC-7): an explicit
+  // keep list takes the keep branch and resolves before the child ever reads
+  // AILK_LICENSE_KEY, so a licence key in the server's own environment can
+  // never turn this anonymous call into the keyed level probe.
+  const result = spawnSync(
+    "node",
+    [bin, targetAbs, "--shape", "organization-product", "--modules", "marketing"],
+    {
+      stdio: ["ignore", "pipe", "pipe"],
+      shell: false,
+      encoding: "utf8",
+    },
+  );
 
   if (result.status !== 0) {
     // Extract the error message from stderr (CLI writes "[create-ailk] <msg>").

package/templates/apps/mcp/src/tools/purchase.ts

@@ -41,8 +41,10 @@
  * simply not part of that shape. Either path is safe: the payload built
  * below can never carry a caller-supplied redirect. The shared
  * `purchaseInputSchema` (and the Server Action / API route that use it) is
- * unaffected: those are not anonymous surfaces and keep accepting a
- * caller-supplied redirect.
+ * unaffected: both keep accepting a caller-supplied redirect. The route's own
+ * anonymous exposure is gated only when `OSS_API_INTERNAL_SECRET` is set
+ * (`passesInternalAuthGate()` in `apps/api/src/routes/checkout/sessions.ts`);
+ * unset — the OSS standalone default — the route accepts anonymous callers.
  *
  * The file stays in the BASE tree and is never added to
  * `MODULE_SLICES.commerce.ownedFiles`: `../server.js` statically imports

package/templates/apps/web/.env.example

@@ -52,6 +52,19 @@ CONTENT_ADAPTER=mdx
 # browser never sees.
 # NEXT_PUBLIC_AILK_API_URL=http://localhost:3002
 
+# =============================================================================
+# apps/api internal-auth secret (server-side only) — #6876
+# =============================================================================
+# SERVER-SIDE ONLY — never rename it with a NEXT_PUBLIC_ prefix. The /dev/purchase
+# Server Action sends it as X-Internal-Auth on POST /v1/checkout/sessions,
+# alongside the buyer's session cookie, so the route can stamp a signed-in
+# buyer's Checkout. Must equal OSS_API_INTERNAL_SECRET in apps/api's
+# environment. Unset on both sides for OSS standalone deployments: the API
+# applies no gate and this app sends no header. Set on the API but not here,
+# and the purchase fails with the route's 401.
+# Generate with: openssl rand -hex 32 (see apps/api/.env.example)
+# OSS_API_INTERNAL_SECRET=your-shared-secret-here
+
 # =============================================================================
 # Better Auth (apps/web)
 # =============================================================================

package/templates/apps/web/CLAUDE.md

@@ -43,7 +43,7 @@ Raw HTML is allowed only when no `@working-theory/ui` component fits. Flag it in
 - Animations: only `transform` and `opacity`. Never `transition-all`.
 - Every interactive element needs hover, focus-visible, and active states.
 
-For the full responsive contract (path-scoped to UI files), see `.claude/rules/responsive.md`. For brand-asset discovery (logos, colors, photos), see `.claude/rules/brand.md`.
+The four widths above are the responsive contract. Brand reference files (logos, photos, colour and type notes) live in `brand_assets/` at the repo root; the site's own brand colours and fonts are set in `content/_site.mdx` under `brand.colors` and `brand.fonts`.
 
 ## Local dev
 
@@ -110,33 +110,27 @@ function — the page under test throws instead of taking a branch. Declare
 every predicate the pages call, binding the two reset ones to the same
 `jest.fn()` when the case does not need them to disagree.
 
-## Conversational intake (contact page)
-
-The contact page (`apps/web/app/[locale]/contact/`) consumes
-`ConversationalIntake` — a chat-style intake block + deterministic engine
-from `@working-theory/ui`, unmodified. The block/engine contract (six-behavior
-mapping, `NextTurn`/`IntakeScript` shapes, the v1/v2 seam) is documented in
-`packages/ui/src/blocks/conversational-intake/README.md`; read that first.
-
-This app's specific wiring: `ConversationalIntakeWrapper.tsx` hosts the
-block and owns submission + fallback; `intake-script.ts` supplies the script
-via `buildContactIntakeScript(copy)`, whose question ids (`name` / `message`
-/ `email`) double as the field-mapping contract into `submitLeadInputSchema`;
-`intake-analytics.ts` fires the `"intake-turn-abandonment"` event once per
-turn (turn index + status only, never answer text) from the block's
-`getThinkingDelayMs` override seam. Completion submits through the existing
-`captureLeadAction`; Skip or a failed submit falls back to the existing
-`<ContactForm/>`, prefilled with whatever was already captured — a lead is
-never silently lost.
-
-**Note:** the contact page currently mounts the wrapper alongside
-`renderPage`'s output (`page.tsx`), not as a page-level swap. A downstream
-Positionary consumer pattern that DID swap the whole page was corrected
-under #4577 (decision D71 — the intake belongs behind the hero CTA's
-lightbox gate; landed in PR #4583 via `packages/ui/src/sections/FormLightbox.tsx`
-and `HeroIntakeContext.tsx`, spec `docs/specs/4577-intake-lightbox-correction-spec.md`).
-Don't take a whole-page mount as the pattern to replicate; the lightbox-gate
-seam is the canonical embedding shape.
+## Contact page
+
+The contact page (`apps/web/app/[locale]/contact/page.tsx`) renders the
+page's sections through `renderPage` and places ONE contact surface: into the
+page's first `contact-form` section, else into a leading split hero's right
+column, else after the page. That surface is the shared `LeadCaptureForm`
+block from `@working-theory/ui`, bound to `captureLeadAction` — unless the
+API reports this deployment accepts no contact message (production with
+neither a database nor an email key), in which case it is `ContactFallback`:
+the site's contact email, never a form that would report a message as sent
+when it reached nobody. A failed status read counts as accepting, so the
+form renders and its submit reports honestly.
+
+The chat-style intake is not mounted by default.
+`ConversationalIntakeWrapper.tsx` remains for a site that prefers it: it hosts
+`@working-theory/ui`'s `ConversationalIntake` block (contract in
+`packages/ui/src/blocks/conversational-intake/README.md`), submits through the
+same `captureLeadAction`, and on Skip or a failed submit swaps to
+`LeadCaptureForm`, prefilled with what was already captured. The canonical
+embedding for it is behind the hero CTA's lightbox gate
+(`packages/ui/src/sections/FormLightbox.tsx`, #4577), not a whole-page mount.
 
 ## AEO & performance
 

package/templates/apps/web/app/[locale]/(auth)/layout.tsx

@@ -24,7 +24,7 @@ import { headers } from "next/headers";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement, ReactNode } from "react";
 
-import { siteLogo } from "../../../lib/site-brand";
+import { siteLogo } from "../../../lib/site-logo";
 
 interface Props {
   children: ReactNode;

package/templates/apps/web/app/[locale]/(authed)/leads/__tests__/page.test.tsx

@@ -10,6 +10,10 @@
  *   4. Renders an EmptyState — not a headerless table — for an empty page.
  *   5. Renders ForbiddenState on a 401/403; falls back to the first page
  *      when a supplied `?cursor=` 400s; rethrows every other error.
+ *   6. With no session, renders ForbiddenState and makes no apps/api request
+ *      — the (authed) layout's gate renders concurrently, so the page must
+ *      not spend (or fail) an API call on a visitor it will never serve
+ *      (#6865).
  */
 import { render, screen } from "@testing-library/react";
 
@@ -26,6 +30,13 @@ jest.mock("next/headers", () => ({
   cookies: jest.fn().mockResolvedValue({ toString: () => "session=abc" }),
 }));
 
+const mockGetSession = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth.ts's lazy Better-Auth singleton has no HTTP/DB boundary a unit test can mock without standing up Prisma.
+jest.mock("../../../../../auth", () => ({
+  __esModule: true,
+  auth: { api: { getSession: (...args: unknown[]) => mockGetSession(...args) } },
+}));
+
 const mockList = jest.fn();
 jest.mock("@working-theory/api-client", () => ({
   __esModule: true,
@@ -64,6 +75,19 @@ function renderPage(cursor?: string) {
 describe("LeadsInboxPage", () => {
   beforeEach(() => {
     mockList.mockReset();
+    mockGetSession.mockReset();
+    mockGetSession.mockResolvedValue({ user: { id: "user_1" } });
+  });
+
+  // #6865: the (authed) layout renders SignInGate to an anonymous visitor,
+  // but Next renders this page concurrently — it must not call apps/api.
+  it("makes no apps/api request and renders ForbiddenState with no session", async () => {
+    mockGetSession.mockResolvedValue(null);
+    render(await renderPage("lead_9"));
+
+    expect(mockList).not.toHaveBeenCalled();
+    expect(screen.getByTestId("waitlist-forbidden")).toBeInTheDocument();
+    expect(screen.queryByTestId("leads-inbox-page")).not.toBeInTheDocument();
   });
 
   it("renders one row per lead, with email and source", async () => {

package/templates/apps/web/app/[locale]/(authed)/leads/page.tsx

@@ -12,15 +12,24 @@
  * waitlist comparison page uses); every other error (a 400 on a malformed
  * cursor, a 500) rethrows to the route's error boundary rather than being
  * swallowed.
+ *
+ * The page reads the session itself before any API call (#6865): Next renders
+ * it concurrently with the (authed) layout, so for an anonymous visitor the
+ * layout's `SignInGate` wins but this page would still have called
+ * `leads.list()` — spending (or, with no API reachable, failing) a request
+ * for a result nobody sees. No session renders `ForbiddenState` with no
+ * apps/api request, the same guard `../account/page.tsx` carries.
  */
 
 import { leads, type LeadInboxPage } from "@working-theory/api-client";
 import { PageHeader } from "@working-theory/ui/blocks";
 import { Container, Heading, Text } from "@working-theory/ui/primitives";
 import type { Metadata } from "next";
+import { headers } from "next/headers";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
+import { auth } from "../../../../auth";
 import { ApiError, forwardedCookieInit, unwrapApiResult } from "../../../../lib/server-api";
 import { ForbiddenState } from "../waitlist/components/ForbiddenState";
 import { formatDateTime } from "../waitlist/format";
@@ -46,6 +55,13 @@ export default async function LeadsInboxPage({
   const { cursor } = await searchParams;
   const t = await getTranslations({ locale, namespace: "leadsInbox" });
 
+  const forbidden = (
+    <ForbiddenState headline={t("forbiddenHeadline")} description={t("forbiddenDescription")} />
+  );
+
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) return forbidden;
+
   const init = await forwardedCookieInit();
 
   let page: LeadInboxPage;
@@ -53,12 +69,7 @@ export default async function LeadsInboxPage({
     page = await unwrapApiResult(leads.list(cursor ? { cursor } : {}, init));
   } catch (err) {
     if (err instanceof ApiError && (err.status === 401 || err.status === 403)) {
-      return (
-        <ForbiddenState
-          headline={t("forbiddenHeadline")}
-          description={t("forbiddenDescription")}
-        />
-      );
+      return forbidden;
     }
     // A 400 means the `?cursor=` in the URL did not resolve — it was typed,
     // or it is a stale next-page link whose row has since gone. That is a bad

package/templates/apps/web/app/[locale]/[slug]/[detail]/__tests__/page.test.tsx

@@ -0,0 +1,110 @@
+/**
+ * Tests for the `[slug]/[detail]` route — the Free `/meet/<slug>` placeholder
+ * detail pages (#6897 D2).
+ *
+ * - `slug !== "meet"` → notFound() immediately, never reaching getMdxSource.
+ * - `slug === "meet"` and a BookCall source exists at `detail` → renders
+ *   through renderPage sections mode, no notFound() call.
+ * - `slug === "meet"` and no BookCall source exists at `detail` → renderPage's
+ *   own detail-route branch (no translationsNamespace passed) calls
+ *   notFound().
+ */
+import React from "react";
+import { render } from "@testing-library/react";
+
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  notFound: jest.fn(() => {
+    throw new Error("NEXT_NOT_FOUND");
+  }),
+}));
+
+jest.mock("@working-theory/ui", () => ({
+  Heading: ({
+    children,
+    level,
+  }: {
+    children: React.ReactNode;
+    level: number;
+  }): React.ReactElement => React.createElement(`h${level}`, null, children),
+  SectionRenderer: ({ sections }: { sections: unknown[] }) =>
+    React.createElement("div", {
+      "data-testid": "section-renderer",
+      "data-section-count": String(sections.length),
+    }),
+}));
+
+import { notFound } from "next/navigation";
+
+import DetailPage from "../page";
+
+const mockNotFound = notFound as jest.MockedFunction<typeof notFound>;
+
+function makeSource(slug: string) {
+  return {
+    frontmatter: {
+      type: "BookCall" as const,
+      slug,
+      title: `Title for ${slug}`,
+      description: `Description for ${slug}`,
+      sections: [
+        {
+          id: "hero",
+          type: "hero" as const,
+          data: { headline: `Title for ${slug}` },
+        },
+      ],
+    },
+    body: "",
+  };
+}
+
+describe("[slug]/[detail] — the Free /meet/<slug> placeholder route (#6897 D2)", () => {
+  beforeEach(() => {
+    mockNotFound.mockClear();
+  });
+
+  it("renders a BookCall seed at meet/<detail> through renderPage sections mode", async () => {
+    const getMdxSource = jest.fn().mockResolvedValue(makeSource("book-a-call"));
+
+    const element = await DetailPage({
+      params: Promise.resolve({ locale: "en", slug: "meet", detail: "book-a-call" }),
+      getMdxSource,
+    });
+    const { container } = render(element);
+
+    expect(getMdxSource).toHaveBeenCalledWith("BookCall", "book-a-call", "en");
+    expect(
+      container.querySelector("[data-testid='section-renderer']"),
+    ).not.toBeNull();
+    expect(
+      container.querySelector("script[type='application/ld+json']"),
+    ).not.toBeNull();
+    expect(mockNotFound).not.toHaveBeenCalled();
+  });
+
+  it("404s for another hub — the guard fires before getMdxSource is ever called", async () => {
+    const getMdxSource = jest.fn().mockResolvedValue(makeSource("book-a-call"));
+
+    await expect(
+      DetailPage({
+        params: Promise.resolve({ locale: "en", slug: "not-meet", detail: "book-a-call" }),
+        getMdxSource,
+      }),
+    ).rejects.toThrow("NEXT_NOT_FOUND");
+    expect(mockNotFound).toHaveBeenCalledTimes(1);
+    expect(getMdxSource).not.toHaveBeenCalled();
+  });
+
+  it("404s for an unknown detail slug under the meet hub", async () => {
+    const getMdxSource = jest.fn().mockResolvedValue(null);
+
+    await expect(
+      DetailPage({
+        params: Promise.resolve({ locale: "en", slug: "meet", detail: "not-a-page" }),
+        getMdxSource,
+      }),
+    ).rejects.toThrow("NEXT_NOT_FOUND");
+    expect(mockNotFound).toHaveBeenCalledTimes(1);
+  });
+});