minutework 0.1.26 → 0.1.28

package/assets/claude-local/CLAUDE.md.template

@@ -190,8 +190,10 @@ a concrete backend responsibility such as:
   `submission` schemas before Builder starts authoring.
 - Author public content against runtime/CMS records and published-web flows, not
   against a fixed in-repo marketing template.
-- Use `MW_CONTENT_API_TOKEN`, `MW_PUBLIC_SITE_PROPERTY_KEY`, and
-  `MW_PUBLIC_SITE_ENV` as the standard site env contract.
+- Use `MW_PUBLIC_CONTENT_SOURCE` to select the public content adapter mode.
+- `MW_CONTENT_API_TOKEN`, `MW_PUBLIC_SITE_PROPERTY_KEY`, and
+  `MW_PUBLIC_SITE_ENV` are required only for `MW_PUBLIC_CONTENT_SOURCE=minutework_cms`.
+- `MW_STATIC_PUBLIC_CONTENT_PATH` is used for `MW_PUBLIC_CONTENT_SOURCE=static_json`.
 - `MW_PUBLIC_SITE_ENV=preview` is for preview or draft-safe reads.
 - `MW_PUBLIC_SITE_ENV=live` is for publication-safe delivery.
 - Anonymous live delivery should prefer published snapshots instead of direct

package/assets/claude-local/skills/published-web-and-mw-core-site/SKILL.md

@@ -26,8 +26,10 @@ flows, or the default MinuteWork site model.
   `contract-first-public-intake/SKILL.md`.
 - Use `published-web` and hosted public-release flows for anonymous delivery by
   default.
+- `MW_PUBLIC_CONTENT_SOURCE` selects the public content adapter mode.
 - `MW_CONTENT_API_TOKEN`, `MW_PUBLIC_SITE_PROPERTY_KEY`, and
-  `MW_PUBLIC_SITE_ENV` are the standard site env variables.
+  `MW_PUBLIC_SITE_ENV` are required only for `MW_PUBLIC_CONTENT_SOURCE=minutework_cms`.
+- `MW_STATIC_PUBLIC_CONTENT_PATH` is used for `MW_PUBLIC_CONTENT_SOURCE=static_json`.
 - `MW_PUBLIC_SITE_ENV=preview` is for preview or draft-safe reads.
 - `MW_PUBLIC_SITE_ENV=live` is for publication-safe reads only.
 - Anonymous live traffic should prefer published snapshots instead of direct

package/assets/templates/next-tenant-app/.env.example

@@ -1,8 +1,9 @@
 MW_PLATFORM_BASE_URL=http://127.0.0.1:8000
+MW_PUBLIC_CONTENT_SOURCE=none
 MW_CONTENT_API_TOKEN=
 MW_TEMPLATE_APP_NAME=MinuteWork Combined Starter
-# Local development example. Set this explicitly per environment.
-MW_PUBLIC_BASE_URL=http://127.0.0.1:3000
-MW_PUBLIC_SITE_PROPERTY_KEY=main-site
+MW_PUBLIC_BASE_URL=
+MW_PUBLIC_SITE_PROPERTY_KEY=
 MW_PUBLIC_SITE_ENV=preview
+MW_STATIC_PUBLIC_CONTENT_PATH=content/public-site.json
 MW_ENABLE_RUNTIME_COMMAND_EXAMPLE=false

package/assets/templates/next-tenant-app/README.md

@@ -89,14 +89,19 @@ When disabled:
 
 ## Environment
 
-Copy `.env.example` to `.env.local` when running the template directly.
+Copy `.env.example` to `.env.local` when running the template directly. The
+example file uses `MW_PUBLIC_CONTENT_SOURCE=none` so the private `/app` surface
+can boot without MinuteWork CMS credentials; set `MW_PUBLIC_CONTENT_SOURCE` to
+`minutework_cms` and fill the CMS values below when enabling the public site.
 
 - `MW_PLATFORM_BASE_URL` is required
-- `MW_CONTENT_API_TOKEN` is required and must stay server-only
+- `MW_PUBLIC_CONTENT_SOURCE` defaults to `none` when omitted; supported values are `minutework_cms`, `custom`, `static_json`, and `none`
+- `MW_CONTENT_API_TOKEN` is required only for `minutework_cms` and must stay server-only
 - `MW_TEMPLATE_APP_NAME` defaults to `MinuteWork Combined Starter`
-- `MW_PUBLIC_BASE_URL` is required and should match the deployed public origin
-- `MW_PUBLIC_SITE_PROPERTY_KEY` is required and selects the `PublishedWebProperty` backing the site
+- `MW_PUBLIC_BASE_URL` is required for public content sources and should match the deployed public origin; it may be omitted when `MW_PUBLIC_CONTENT_SOURCE=none`
+- `MW_PUBLIC_SITE_PROPERTY_KEY` is required only for `minutework_cms` and selects the `PublishedWebProperty` backing the site
 - `MW_PUBLIC_SITE_ENV` defaults to `preview`
+- `MW_STATIC_PUBLIC_CONTENT_PATH` defaults to `content/public-site.json` and is used when `MW_PUBLIC_CONTENT_SOURCE=static_json`
 - `MW_ENABLE_RUNTIME_COMMAND_EXAMPLE` defaults to `false`
 
 ## SEO baseline

package/assets/templates/next-tenant-app/src/app/(cms)/[...path]/page.tsx

@@ -4,11 +4,19 @@ import { notFound } from "next/navigation";
 import { ContentStructureRenderer } from "@/features/public-shell/components/section-renderer";
 import { PublicSiteShell } from "@/features/public-shell/components/public-site-shell";
 import { getPageByPath, getSiteConfig, listPages } from "@/lib/content/adapter.server";
-import { buildPublicMetadata } from "@/lib/public-site";
+import {
+  buildDisabledPublicMetadata,
+  buildPublicMetadata,
+  isPublicContentDisabled,
+} from "@/lib/public-site";
 
 type PageParams = { path: string[] };
 
 export async function generateStaticParams(): Promise<PageParams[]> {
+  if (isPublicContentDisabled()) {
+    return [];
+  }
+
   const pages = await listPages("published");
   return pages
     .filter((p) => p.path !== "/")
@@ -22,6 +30,10 @@ export async function generateMetadata({
 }: {
   params: Promise<PageParams>;
 }): Promise<Metadata> {
+  if (isPublicContentDisabled()) {
+    return buildDisabledPublicMetadata();
+  }
+
   const { path: pathSegments } = await params;
   const pagePath = `/${pathSegments.join("/")}`;
   const page = await getPageByPath(pagePath);
@@ -41,6 +53,10 @@ export default async function CmsPage({
 }: {
   params: Promise<PageParams>;
 }) {
+  if (isPublicContentDisabled()) {
+    notFound();
+  }
+
   const { path: pathSegments } = await params;
   const pagePath = `/${pathSegments.join("/")}`;
   const [siteConfig, page] = await Promise.all([

package/assets/templates/next-tenant-app/src/app/app/private-content-source.test.ts

@@ -0,0 +1,88 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const originalEnv = { ...process.env };
+const resolveAuthenticatedSession = vi.fn();
+
+function restoreProcessEnv() {
+  for (const key of Object.keys(process.env)) {
+    if (!(key in originalEnv)) {
+      delete process.env[key];
+    }
+  }
+
+  Object.assign(process.env, originalEnv);
+}
+
+function applyPrivateOnlyServerEnv() {
+  restoreProcessEnv();
+  process.env.MW_PLATFORM_BASE_URL = "http://127.0.0.1:8000";
+  process.env.MW_PUBLIC_CONTENT_SOURCE = "none";
+  process.env.MW_TEMPLATE_APP_NAME = "Private Only Workspace";
+  process.env.MW_ENABLE_RUNTIME_COMMAND_EXAMPLE = "false";
+  delete process.env.MW_CONTENT_API_TOKEN;
+  delete process.env.MW_PUBLIC_BASE_URL;
+  delete process.env.MW_PUBLIC_SITE_PROPERTY_KEY;
+}
+
+vi.mock("@/features/shell/components/private-app-shell", () => ({
+  PrivateAppShell: () => null,
+}));
+
+vi.mock("@/lib/platform/auth.server", () => ({
+  resolveAuthenticatedSession,
+}));
+
+vi.mock("@/lib/platform/endpoints.server", () => ({
+  platformAuthEndpoints: {
+    operatorConsole: "http://127.0.0.1:8000/ops/login/",
+  },
+}));
+
+describe("private app routes with disabled public content", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.resetModules();
+    applyPrivateOnlyServerEnv();
+    resolveAuthenticatedSession.mockResolvedValue({
+      authenticated: true,
+      user: {
+        id: "user-1",
+        username: "demo-user",
+        email: "demo@example.com",
+      },
+      active_tenant_id: "tenant-1",
+      active_tenant: {
+        tenant_id: "tenant-1",
+        tenant_slug: "alpha",
+        tenant_name: "Alpha",
+        role: "admin",
+      },
+      memberships: [
+        {
+          tenant_id: "tenant-1",
+          tenant_slug: "alpha",
+          tenant_name: "Alpha",
+          role: "admin",
+        },
+      ],
+    });
+  });
+
+  afterEach(() => {
+    restoreProcessEnv();
+    vi.resetModules();
+  });
+
+  it("imports /app entrypoints without CMS or public base environment", async () => {
+    const [layout, page] = await Promise.all([
+      import("./layout"),
+      import("./page"),
+    ]);
+
+    await expect(layout.default({ children: "workspace" })).resolves.toBe(
+      "workspace",
+    );
+    await expect(page.default()).resolves.toBeDefined();
+    expect(resolveAuthenticatedSession).toHaveBeenCalledTimes(2);
+  });
+});

package/assets/templates/next-tenant-app/src/app/blog/[slug]/page.tsx

@@ -4,7 +4,11 @@ import { ContentArticle } from "@/features/public-shell/components/content-artic
 import { PublicSiteShell } from "@/features/public-shell/components/public-site-shell";
 import { getEntry, getSiteConfig, listEntries } from "@/lib/content/adapter.server";
 import { appRoutes } from "@/lib/app-routes";
-import { buildPublicMetadata } from "@/lib/public-site";
+import {
+  buildDisabledPublicMetadata,
+  buildPublicMetadata,
+  isPublicContentDisabled,
+} from "@/lib/public-site";
 
 type BlogArticlePageProps = {
   params: Promise<{ slug: string }>;
@@ -13,12 +17,20 @@ type BlogArticlePageProps = {
 export const dynamicParams = false;
 
 export async function generateStaticParams() {
+  if (isPublicContentDisabled()) {
+    return [];
+  }
+
   return (await listEntries("blog")).map((entry) => ({
     slug: entry.slug[0],
   }));
 }
 
 export async function generateMetadata({ params }: BlogArticlePageProps) {
+  if (isPublicContentDisabled()) {
+    return buildDisabledPublicMetadata();
+  }
+
   const [{ slug }, siteConfig] = await Promise.all([params, getSiteConfig()]);
   const entry = await getEntry("blog", [slug]);
 
@@ -42,6 +54,10 @@ export async function generateMetadata({ params }: BlogArticlePageProps) {
 }
 
 export default async function BlogArticlePage({ params }: BlogArticlePageProps) {
+  if (isPublicContentDisabled()) {
+    notFound();
+  }
+
   const [{ slug }, siteConfig] = await Promise.all([params, getSiteConfig()]);
   const entry = await getEntry("blog", [slug]);
 

package/assets/templates/next-tenant-app/src/app/blog/page.test.ts

@@ -16,6 +16,10 @@ vi.mock("@/lib/content/adapter.server", () => ({
   listEntries,
 }));
 
+vi.mock("next/navigation", () => ({
+  notFound: vi.fn(),
+}));
+
 describe("blog index page", () => {
   beforeEach(() => {
     vi.clearAllMocks();

package/assets/templates/next-tenant-app/src/app/blog/page.tsx

@@ -1,10 +1,20 @@
+import { notFound } from "next/navigation";
+
 import { ContentCollection } from "@/features/public-shell/components/content-collection";
 import { PublicSiteShell } from "@/features/public-shell/components/public-site-shell";
 import { getSiteConfig, listEntries } from "@/lib/content/adapter.server";
 import { appRoutes } from "@/lib/app-routes";
-import { buildPublicMetadata } from "@/lib/public-site";
+import {
+  buildDisabledPublicMetadata,
+  buildPublicMetadata,
+  isPublicContentDisabled,
+} from "@/lib/public-site";
 
 export async function generateMetadata() {
+  if (isPublicContentDisabled()) {
+    return buildDisabledPublicMetadata();
+  }
+
   const siteConfig = await getSiteConfig();
   const collection = siteConfig.collections.blog;
 
@@ -17,6 +27,10 @@ export async function generateMetadata() {
 }
 
 export default async function BlogIndexPage() {
+  if (isPublicContentDisabled()) {
+    notFound();
+  }
+
   const [siteConfig, entries] = await Promise.all([
     getSiteConfig(),
     listEntries("blog"),

package/assets/templates/next-tenant-app/src/app/docs/[...slug]/page.tsx

@@ -4,7 +4,11 @@ import { ContentArticle } from "@/features/public-shell/components/content-artic
 import { PublicSiteShell } from "@/features/public-shell/components/public-site-shell";
 import { getEntry, getSiteConfig, listEntries } from "@/lib/content/adapter.server";
 import { appRoutes } from "@/lib/app-routes";
-import { buildPublicMetadata } from "@/lib/public-site";
+import {
+  buildDisabledPublicMetadata,
+  buildPublicMetadata,
+  isPublicContentDisabled,
+} from "@/lib/public-site";
 
 type DocsArticlePageProps = {
   params: Promise<{ slug: string[] }>;
@@ -13,12 +17,20 @@ type DocsArticlePageProps = {
 export const dynamicParams = false;
 
 export async function generateStaticParams() {
+  if (isPublicContentDisabled()) {
+    return [];
+  }
+
   return (await listEntries("docs")).map((entry) => ({
     slug: entry.slug,
   }));
 }
 
 export async function generateMetadata({ params }: DocsArticlePageProps) {
+  if (isPublicContentDisabled()) {
+    return buildDisabledPublicMetadata();
+  }
+
   const [{ slug }, siteConfig] = await Promise.all([params, getSiteConfig()]);
   const entry = await getEntry("docs", slug);
 
@@ -40,6 +52,10 @@ export async function generateMetadata({ params }: DocsArticlePageProps) {
 }
 
 export default async function DocsArticlePage({ params }: DocsArticlePageProps) {
+  if (isPublicContentDisabled()) {
+    notFound();
+  }
+
   const [{ slug }, siteConfig] = await Promise.all([params, getSiteConfig()]);
   const entry = await getEntry("docs", slug);
 

package/assets/templates/next-tenant-app/src/app/docs/page.test.ts

@@ -16,6 +16,10 @@ vi.mock("@/lib/content/adapter.server", () => ({
   listEntries,
 }));
 
+vi.mock("next/navigation", () => ({
+  notFound: vi.fn(),
+}));
+
 describe("docs index page", () => {
   beforeEach(() => {
     vi.clearAllMocks();

package/assets/templates/next-tenant-app/src/app/docs/page.tsx

@@ -1,10 +1,20 @@
+import { notFound } from "next/navigation";
+
 import { ContentCollection } from "@/features/public-shell/components/content-collection";
 import { PublicSiteShell } from "@/features/public-shell/components/public-site-shell";
 import { getSiteConfig, listEntries } from "@/lib/content/adapter.server";
 import { appRoutes } from "@/lib/app-routes";
-import { buildPublicMetadata } from "@/lib/public-site";
+import {
+  buildDisabledPublicMetadata,
+  buildPublicMetadata,
+  isPublicContentDisabled,
+} from "@/lib/public-site";
 
 export async function generateMetadata() {
+  if (isPublicContentDisabled()) {
+    return buildDisabledPublicMetadata();
+  }
+
   const siteConfig = await getSiteConfig();
   const collection = siteConfig.collections.docs;
 
@@ -17,6 +27,10 @@ export async function generateMetadata() {
 }
 
 export default async function DocsIndexPage() {
+  if (isPublicContentDisabled()) {
+    notFound();
+  }
+
   const [siteConfig, entries] = await Promise.all([
     getSiteConfig(),
     listEntries("docs"),

package/assets/templates/next-tenant-app/src/app/layout.tsx

@@ -24,8 +24,10 @@ const geistMono = Geist_Mono({
 });
 
 export function generateMetadata(): Metadata {
+  const metadataBase = resolvePublicMetadataBase();
+
   return {
-    metadataBase: resolvePublicMetadataBase(),
+    ...(metadataBase ? { metadataBase } : {}),
     title: {
       default: env.MW_TEMPLATE_APP_NAME,
       template: `%s | ${env.MW_TEMPLATE_APP_NAME}`,
@@ -36,9 +38,9 @@ export function generateMetadata(): Metadata {
       title: env.MW_TEMPLATE_APP_NAME,
       description:
         "SEO-first public and authenticated Next.js starter with a server-owned platform session BFF.",
-      url: env.MW_PUBLIC_BASE_URL,
       siteName: env.MW_TEMPLATE_APP_NAME,
       type: "website",
+      ...(env.MW_PUBLIC_BASE_URL ? { url: env.MW_PUBLIC_BASE_URL } : {}),
     },
   };
 }

package/assets/templates/next-tenant-app/src/app/page.test.ts

@@ -16,6 +16,10 @@ vi.mock("@/lib/content/adapter.server", () => ({
   getSiteConfig,
 }));
 
+vi.mock("next/navigation", () => ({
+  notFound: vi.fn(),
+}));
+
 describe("home page", () => {
   beforeEach(() => {
     vi.clearAllMocks();

package/assets/templates/next-tenant-app/src/app/page.tsx

@@ -1,11 +1,21 @@
+import { notFound } from "next/navigation";
+
 import { MarketingPageCanvas } from "@/features/public-shell/components/marketing-page-canvas";
 import { PublicSiteShell } from "@/features/public-shell/components/public-site-shell";
 import { getMarketingPage, getSiteConfig } from "@/lib/content/adapter.server";
 import { buildEmptyMarketingPage } from "@/lib/content/empty-state";
 import { appRoutes } from "@/lib/app-routes";
-import { buildPublicMetadata } from "@/lib/public-site";
+import {
+  buildDisabledPublicMetadata,
+  buildPublicMetadata,
+  isPublicContentDisabled,
+} from "@/lib/public-site";
 
 export async function generateMetadata() {
+  if (isPublicContentDisabled()) {
+    return buildDisabledPublicMetadata();
+  }
+
   const [siteConfig, page] = await Promise.all([
     getSiteConfig(),
     getMarketingPage("home"),
@@ -21,6 +31,10 @@ export async function generateMetadata() {
 }
 
 export default async function HomePage() {
+  if (isPublicContentDisabled()) {
+    notFound();
+  }
+
   const [siteConfig, page] = await Promise.all([
     getSiteConfig(),
     getMarketingPage("home"),

package/assets/templates/next-tenant-app/src/app/pricing/page.test.ts

@@ -16,6 +16,10 @@ vi.mock("@/lib/content/adapter.server", () => ({
   getSiteConfig,
 }));
 
+vi.mock("next/navigation", () => ({
+  notFound: vi.fn(),
+}));
+
 describe("pricing page", () => {
   beforeEach(() => {
     vi.clearAllMocks();

package/assets/templates/next-tenant-app/src/app/pricing/page.tsx

@@ -1,11 +1,21 @@
+import { notFound } from "next/navigation";
+
 import { MarketingPageCanvas } from "@/features/public-shell/components/marketing-page-canvas";
 import { PublicSiteShell } from "@/features/public-shell/components/public-site-shell";
 import { getMarketingPage, getSiteConfig } from "@/lib/content/adapter.server";
 import { buildEmptyMarketingPage } from "@/lib/content/empty-state";
 import { appRoutes } from "@/lib/app-routes";
-import { buildPublicMetadata } from "@/lib/public-site";
+import {
+  buildDisabledPublicMetadata,
+  buildPublicMetadata,
+  isPublicContentDisabled,
+} from "@/lib/public-site";
 
 export async function generateMetadata() {
+  if (isPublicContentDisabled()) {
+    return buildDisabledPublicMetadata();
+  }
+
   const [siteConfig, page] = await Promise.all([
     getSiteConfig(),
     getMarketingPage("pricing"),
@@ -21,6 +31,10 @@ export async function generateMetadata() {
 }
 
 export default async function PricingPage() {
+  if (isPublicContentDisabled()) {
+    notFound();
+  }
+
   const [siteConfig, page] = await Promise.all([
     getSiteConfig(),
     getMarketingPage("pricing"),

package/assets/templates/next-tenant-app/src/app/robots.test.ts

@@ -1,11 +1,15 @@
-import { describe, expect, it } from "vitest";
-
-import robots from "./robots";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 
 describe("robots route", () => {
-  it("returns a public robots policy and sitemap url", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.doUnmock("@/lib/public-site");
+  });
+
+  it("returns a public robots policy and sitemap url", async () => {
     expect(process.env.MW_PUBLIC_BASE_URL).toBe("http://127.0.0.1:3000");
 
+    const { default: robots } = await import("./robots");
     const metadata = robots();
 
     expect(metadata.host).toBe("127.0.0.1:3000");
@@ -17,4 +21,20 @@ describe("robots route", () => {
       },
     ]);
   });
+
+  it("disallows indexing when public content is disabled", async () => {
+    vi.doMock("@/lib/public-site", () => ({
+      isPublicContentDisabled: () => true,
+      resolvePublicMetadataBase: () => null,
+    }));
+
+    const { default: robots } = await import("./robots");
+
+    expect(robots().rules).toEqual([
+      {
+        userAgent: "*",
+        disallow: "/",
+      },
+    ]);
+  });
 });

package/assets/templates/next-tenant-app/src/app/robots.ts

@@ -1,10 +1,24 @@
 import type { MetadataRoute } from "next";
 
-import { resolvePublicMetadataBase } from "@/lib/public-site";
+import {
+  isPublicContentDisabled,
+  resolvePublicMetadataBase,
+} from "@/lib/public-site";
 
 export default function robots(): MetadataRoute.Robots {
   const metadataBase = resolvePublicMetadataBase();
 
+  if (!metadataBase || isPublicContentDisabled()) {
+    return {
+      rules: [
+        {
+          userAgent: "*",
+          disallow: "/",
+        },
+      ],
+    };
+  }
+
   return {
     rules: [
       {

package/assets/templates/next-tenant-app/src/app/sitemap.test.ts

@@ -8,11 +8,11 @@ vi.mock("@/lib/content/adapter.server", () => ({
   listEntries,
 }));
 
-import sitemap from "./sitemap";
-
 describe("sitemap route", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    vi.resetModules();
+    vi.doUnmock("@/lib/public-site");
   });
 
   it("includes the public route surface and published content entries", async () => {
@@ -24,6 +24,7 @@ describe("sitemap route", () => {
 
     expect(process.env.MW_PUBLIC_BASE_URL).toBe("http://127.0.0.1:3000");
 
+    const { default: sitemap } = await import("./sitemap");
     const entries = await sitemap();
     const urls = entries.map((entry) => entry.url);
 
@@ -38,6 +39,7 @@ describe("sitemap route", () => {
   it("keeps home and pricing in the sitemap even when the snapshot has no marketing pages", async () => {
     listEntries.mockResolvedValue([]);
 
+    const { default: sitemap } = await import("./sitemap");
     const entries = await sitemap();
     const urls = entries.map((entry) => entry.url);
 
@@ -46,4 +48,16 @@ describe("sitemap route", () => {
     expect(urls).toContain("http://127.0.0.1:3000/docs");
     expect(urls).toContain("http://127.0.0.1:3000/blog");
   });
+
+  it("returns an empty sitemap when public content is disabled", async () => {
+    vi.doMock("@/lib/public-site", () => ({
+      isPublicContentDisabled: () => true,
+      resolvePublicSiteUrl: vi.fn(),
+    }));
+
+    const { default: sitemap } = await import("./sitemap");
+
+    await expect(sitemap()).resolves.toEqual([]);
+    expect(listEntries).not.toHaveBeenCalled();
+  });
 });