minutework 0.1.31 → 0.1.33

package/assets/templates/next-tenant-app/README.md

@@ -3,157 +3,45 @@
 This directory is the canonical combined Next.js web starter for Builder.
 
 In the runtime Builder flow, this bundle materializes into
-`BuilderWorkspace.sandbox_root/app/`.
+`BuilderWorkspace.sandbox_root/app/`. In the external CLI scaffold flow, the
+same starter is copied into `tenant-app/`.
 
-In the external CLI scaffold flow, the same starter is copied into
-`tenant-app/`.
-
-On managed tenant VMs, `BuilderWorkspace.sandbox_root` normally lives under
-`/srv/minutework/workspaces/<workspace_id>/`, so the Builder-edited app copy is
-typically `/srv/minutework/workspaces/<workspace_id>/app/`.
-
-`apps/mw-next-client` is still the repo-side seed used to harden and evolve this scaffold. It is not the runtime template location.
+`apps/mw-next-client` may still seed visual conventions, but this template is
+no longer a platform-session BFF app.
 
 ## Auth profile
 
-This template stays fixed to the `platform_session_bff` profile:
-
-- browsers use this BFF only (cookie session, server-owned CSRF); native clients
-  (e.g. a mobile app) instead use a platform-issued native session token
-  directly against `/api/v1/native/...` -- see the `mobile` starter /
-  `standalone-mobile-client` skill
-- upstream platform `sessionid` and `csrftoken` stay server-owned
-- unsafe upstream requests bootstrap and forward CSRF through the BFF
-- there is no browser-to-runtime direct access
-- there is no local JWT system, local user table, or parallel auth stack
-
-## Runtime requirements
-
-- Node.js `20.9.0` or newer
-- `pnpm@9.0.0`
+This template uses the `tenant_web_auth_sdk` profile:
 
-## Direct web hosts
+- browser auth and manifest API calls go through `@minutework/web-auth`
+- the browser stores no bearer token, runtime key, or platform credential
+- SDK calls use same-origin `/_mw` routes with `credentials: "include"`
+- CSRF is handled by the SDK using the non-secret CSRF cookie
+- runtime query/action calls are authorized as `principal_kind=tenant_customer`
 
-When this starter lives inside an external CLI workspace with an optional
-`sidecar`, deploy direct web hosts against `tenant-app` only.
-
-- Root `pnpm install` stays Node-only and does not auto-install sidecar Python deps.
-- If you need the sidecar locally, run `pnpm run install:sidecar` from the workspace root or `cd sidecar && poetry install`.
-- For Vercel, set the project Root Directory to `tenant-app`.
-
-Those host-specific instructions apply to the CLI scaffold layout, not the
-runtime Builder sandbox layout under `app/`.
+Only `src/mw/` is MinuteWork substrate. Keep product UI and product logic in
+`src/app`, `src/features`, and developer-owned modules.
 
 ## Default route shape
 
-The template ships one combined app with two explicit route surfaces:
-
-- public routes at the root: `/`, `/pricing`, `/docs`, `/blog`, `/login`
-- authenticated routes under `/app`
-- optional runtime example under `/app/examples/runtime-commands`
-
-Public marketing, docs, and blog routes render through a swappable public-content adapter seam. The authenticated shell keeps tenant context controls, password flows, and the platform-session BFF boundary.
-
-## Public content adapter
-
-The public content seam lives under `src/lib/content`.
-
-The default built-in adapter is `MinuteWorkPublicSiteContentAdapter`. It calls the
-PandaWork gateway with a server-only content token and reads the narrow
-`mw.core.site` public-site snapshot contract.
-
-`mw.core.site` is treated as a runtime baseline capability. This starter
-composes against that baseline rather than trying to install it locally.
-
-The gateway response carries an explicit boundary:
-
-- `environment=preview` must declare `source_boundary=runtime_preview`
-- `environment=live` may declare `source_boundary=published_live` for hosted releases or `source_boundary=runtime_live` for runtime-served sidecar releases
-
-That keeps preview free to use runtime-backed draft reads while keeping live
-publication-safe for hosted delivery while still allowing an explicit
-runtime-served public lane when the release is activated through
-`runtime_local_sidecar`.
-
-To replace the built-ins for a tenant-specific CMS or content API, implement the hook in `src/lib/content/custom-adapter.ts`.
-
-## Example gating
+- public routes at `/`, `/pricing`, `/docs`, and `/blog`
+- customer auth at `/login`
+- authenticated workspace at `/app`
+- SDK manifest demo at `/app/demo`
 
-`MW_ENABLE_RUNTIME_COMMAND_EXAMPLE=false` by default.
-
-When disabled:
-
-- `/app/examples/runtime-commands` returns `404`
-- the example gateway API routes return `404`
-- the example navigation entry is omitted
+The template intentionally does not include `src/lib/platform/*`,
+`src/app/api/auth/*`, `src/app/api/gateway/*`, an operator-console link, a
+runtime-command demo, or a server-only public-content token adapter.
 
 ## Environment
 
-Copy `.env.example` to `.env.local` when running the template directly. The
-example file uses `MW_PUBLIC_CONTENT_SOURCE=none` so the private `/app` surface
-can boot without PandaWork CMS credentials; set `MW_PUBLIC_CONTENT_SOURCE` to
-`minutework_cms` and fill the CMS values below when enabling the public site.
-
-- `MW_PLATFORM_BASE_URL` is required
-- `MW_PUBLIC_CONTENT_SOURCE` defaults to `none` when omitted; supported values are `minutework_cms`, `custom`, `static_json`, and `none`
-- `MW_CONTENT_API_TOKEN` is required only for `minutework_cms` and must stay server-only
-- `MW_TEMPLATE_APP_NAME` defaults to `PandaWork Combined Starter`
-- `MW_PUBLIC_BASE_URL` is required for public content sources and should match the deployed public origin; it may be omitted when `MW_PUBLIC_CONTENT_SOURCE=none`
-- `MW_PUBLIC_SITE_PROPERTY_KEY` is required only for `minutework_cms` and selects the `PublishedWebProperty` backing the site
-- `MW_PUBLIC_SITE_ENV` defaults to `preview`
-- `MW_STATIC_PUBLIC_CONTENT_PATH` defaults to `content/public-site.json` and is used when `MW_PUBLIC_CONTENT_SOURCE=static_json`
-- `MW_ENABLE_RUNTIME_COMMAND_EXAMPLE` defaults to `false`
-
-## SEO baseline
-
-The public route surface ships with:
-
-- canonical URLs derived from `MW_PUBLIC_BASE_URL`
-- `robots.ts` and `sitemap.ts`
-- Open Graph metadata for marketing and article/detail pages
-- server-rendered public pages by default, with no tenant/session reads during render
-- docs/blog static params generated from the same public-site snapshot used during render
-- graceful empty states for fresh properties with no authored or no published content
-
-Private routes under `/app` are marked `noindex`.
-
-## Generated artifact policy
-
-Checked-in generated artifacts are limited to:
-
-- `next-env.d.ts`
-- `src/design-system/tokens/manifest.ts`
-- `src/design-system/tokens/manifest.json`
-- `pnpm-lock.yaml`
-
-Generated build outputs such as `.next/`, `storybook-static/`, `test-results/`, and `tools/design-system/__screenshots__/` are not canonical template contents.
+- `NEXT_PUBLIC_MW_APP_ID` selects the manifest app id used by the SDK and
+  defaults to `tenant.app`
+- `MW_TEMPLATE_APP_NAME` controls the display name and defaults to `Tenant App`
+- `MW_PUBLIC_BASE_URL` is optional and only affects metadata routes
 
 ## Validation
 
-Use `pnpm validate` from this directory. It runs:
-
-1. `template:validate`
-2. `template:route-contract`
-3. `next typegen`
-4. `design-system:tokens`
-5. `design-system:check`
-6. `typecheck`
-7. `lint`
-8. `test`
-9. `build:validate`
-10. `build-storybook:validate`
-
-`template:validate` validates `template.json` against the bundled `template.schema.json`, so the template remains self-validating after Builder materializes it into a workspace sandbox.
-
-When the CLI scaffolds this starter into `tenant-app/`, the same validation
-contract still applies to that copied workspace surface. When Runtime Builder
-materializes it into `app/`, the same validation contract applies there too.
-
-The validation-only build steps inject fixture values for the required
-production env vars and run against a local public-site fixture server, so the
-template can prove its build contract in-repo without weakening the real
-`pnpm build` requirement.
-
-`template:route-contract` verifies that the combined public/private route tree, metadata routes, and content-adapter entrypoints remain present in the template.
-
-Inside the repo, the shared schema at `runtime/builder/templates/template.schema.json` is authoritative. The bundled `template.schema.json` inside this template must stay byte-equivalent, and `template:validate` fails if the two drift.
+Use `pnpm validate` from this directory. It runs template validation, route
+contract validation, typegen, design-system checks, typecheck, tests, and build
+validation.

package/assets/templates/next-tenant-app/package.json

@@ -27,6 +27,7 @@
     "design-system:visual": "playwright test -c tools/design-system/playwright.config.mjs"
   },
   "dependencies": {
+    "@minutework/web-auth": "^0.1.0",
     "@radix-ui/react-slot": "^1.2.4",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",

package/assets/templates/next-tenant-app/src/app/app/demo/page.tsx

@@ -0,0 +1,15 @@
+import { ManifestDemo } from "@/features/demo/components/manifest-demo";
+
+export const metadata = {
+  title: "Demo",
+};
+
+export default function DemoPage() {
+  return (
+    <main className="min-h-screen bg-background text-foreground">
+      <div className="mx-auto flex min-h-screen max-w-5xl flex-col gap-6 px-6 py-8">
+        <ManifestDemo />
+      </div>
+    </main>
+  );
+}

package/assets/templates/next-tenant-app/src/app/app/layout.tsx

@@ -1,8 +1,6 @@
 import type { Metadata } from "next";
 import type { ReactNode } from "react";
 
-import { resolveAuthenticatedSession } from "@/lib/platform/auth.server";
-
 export const metadata: Metadata = {
   robots: {
     index: false,
@@ -10,11 +8,10 @@ export const metadata: Metadata = {
   },
 };
 
-export default async function AuthenticatedAppLayout({
+export default function AuthenticatedAppLayout({
   children,
 }: {
   children: ReactNode;
 }) {
-  await resolveAuthenticatedSession();
   return children;
 }

package/assets/templates/next-tenant-app/src/app/app/page.tsx

@@ -1,24 +1,9 @@
 import { PrivateAppShell } from "@/features/shell/components/private-app-shell";
-import { resolveAuthenticatedSession } from "@/lib/platform/auth.server";
-import { platformAuthEndpoints } from "@/lib/platform/endpoints.server";
-import { env } from "@/lib/platform/env.server";
 
 export const metadata = {
   title: "Workspace",
-  description:
-    "Authenticated workspace surface for the combined PandaWork starter.",
 };
 
-export default async function AppHomePage() {
-  const session = await resolveAuthenticatedSession();
-
-  return (
-    <PrivateAppShell
-      initialSession={session}
-      appName={env.MW_TEMPLATE_APP_NAME}
-      operatorConsoleHref={platformAuthEndpoints.operatorConsole}
-      runtimeCommandExampleEnabled={env.MW_ENABLE_RUNTIME_COMMAND_EXAMPLE}
-      view="dashboard"
-    />
-  );
+export default function AppHomePage() {
+  return <PrivateAppShell appName={process.env.MW_TEMPLATE_APP_NAME || "Tenant App"} />;
 }

package/assets/templates/next-tenant-app/src/app/blog/[slug]/page.tsx

@@ -1,73 +1,15 @@
-import { notFound } from "next/navigation";
+import { StaticPublicPage } from "@/features/public-shell/components/static-public-page";
 
-import { ContentArticle } from "@/features/public-shell/components/content-article";
-import { PublicSiteShell } from "@/features/public-shell/components/public-site-shell";
-import { getEntry, getSiteConfig, listEntries } from "@/lib/content/adapter.server";
-import { appRoutes } from "@/lib/app-routes";
-import {
-  buildDisabledPublicMetadata,
-  buildPublicMetadata,
-  isPublicContentDisabled,
-} from "@/lib/public-site";
-
-type BlogArticlePageProps = {
-  params: Promise<{ slug: string }>;
+export const metadata = {
+  title: "Blog",
 };
 
-export const dynamicParams = false;
-
-export async function generateStaticParams() {
-  if (isPublicContentDisabled()) {
-    return [];
-  }
-
-  return (await listEntries("blog")).map((entry) => ({
-    slug: entry.slug[0],
-  }));
-}
-
-export async function generateMetadata({ params }: BlogArticlePageProps) {
-  if (isPublicContentDisabled()) {
-    return buildDisabledPublicMetadata();
-  }
-
-  const [{ slug }, siteConfig] = await Promise.all([params, getSiteConfig()]);
-  const entry = await getEntry("blog", [slug]);
-
-  if (!entry) {
-    return buildPublicMetadata({
-      title: siteConfig.collections.blog.title,
-      description: siteConfig.collections.blog.description,
-      path: appRoutes.blogIndex,
-      siteName: siteConfig.siteName,
-    });
-  }
-
-  return buildPublicMetadata({
-    title: entry.seo.title,
-    description: entry.seo.description,
-    path: appRoutes.blogPost(entry.slug),
-    siteName: siteConfig.siteName,
-    type: "article",
-    publishedTime: entry.publishedAt,
-  });
-}
-
-export default async function BlogArticlePage({ params }: BlogArticlePageProps) {
-  if (isPublicContentDisabled()) {
-    notFound();
-  }
-
-  const [{ slug }, siteConfig] = await Promise.all([params, getSiteConfig()]);
-  const entry = await getEntry("blog", [slug]);
-
-  if (!entry) {
-    notFound();
-  }
-
+export default function BlogPostPage() {
   return (
-    <PublicSiteShell activeHref={appRoutes.blogIndex} siteConfig={siteConfig}>
-      <ContentArticle entry={entry} />
-    </PublicSiteShell>
+    <StaticPublicPage
+      eyebrow="Blog"
+      title="Update"
+      body="A customer-facing update."
+    />
   );
 }

package/assets/templates/next-tenant-app/src/app/blog/page.tsx

@@ -1,51 +1,15 @@
-import { notFound } from "next/navigation";
+import { StaticPublicPage } from "@/features/public-shell/components/static-public-page";
 
-import { ContentCollection } from "@/features/public-shell/components/content-collection";
-import { PublicSiteShell } from "@/features/public-shell/components/public-site-shell";
-import { getSiteConfig, listEntries } from "@/lib/content/adapter.server";
-import { appRoutes } from "@/lib/app-routes";
-import {
-  buildDisabledPublicMetadata,
-  buildPublicMetadata,
-  isPublicContentDisabled,
-} from "@/lib/public-site";
-
-export async function generateMetadata() {
-  if (isPublicContentDisabled()) {
-    return buildDisabledPublicMetadata();
-  }
-
-  const siteConfig = await getSiteConfig();
-  const collection = siteConfig.collections.blog;
-
-  return buildPublicMetadata({
-    title: collection.title,
-    description: collection.description,
-    path: appRoutes.blogIndex,
-    siteName: siteConfig.siteName,
-  });
-}
-
-export default async function BlogIndexPage() {
-  if (isPublicContentDisabled()) {
-    notFound();
-  }
-
-  const [siteConfig, entries] = await Promise.all([
-    getSiteConfig(),
-    listEntries("blog"),
-  ]);
-  const collection = siteConfig.collections.blog;
+export const metadata = {
+  title: "Blog",
+};
 
+export default function BlogIndexPage() {
   return (
-    <PublicSiteShell activeHref={appRoutes.blogIndex} siteConfig={siteConfig}>
-      <ContentCollection
-        description={collection.description}
-        entries={entries}
-        eyebrow={collection.eyebrow}
-        kind="blog"
-        title={collection.title}
-      />
-    </PublicSiteShell>
+    <StaticPublicPage
+      eyebrow="Blog"
+      title="Updates"
+      body="News, releases, and customer notes."
+    />
   );
 }

package/assets/templates/next-tenant-app/src/app/docs/[...slug]/page.tsx

@@ -1,71 +1,15 @@
-import { notFound } from "next/navigation";
+import { StaticPublicPage } from "@/features/public-shell/components/static-public-page";
 
-import { ContentArticle } from "@/features/public-shell/components/content-article";
-import { PublicSiteShell } from "@/features/public-shell/components/public-site-shell";
-import { getEntry, getSiteConfig, listEntries } from "@/lib/content/adapter.server";
-import { appRoutes } from "@/lib/app-routes";
-import {
-  buildDisabledPublicMetadata,
-  buildPublicMetadata,
-  isPublicContentDisabled,
-} from "@/lib/public-site";
-
-type DocsArticlePageProps = {
-  params: Promise<{ slug: string[] }>;
+export const metadata = {
+  title: "Docs",
 };
 
-export const dynamicParams = false;
-
-export async function generateStaticParams() {
-  if (isPublicContentDisabled()) {
-    return [];
-  }
-
-  return (await listEntries("docs")).map((entry) => ({
-    slug: entry.slug,
-  }));
-}
-
-export async function generateMetadata({ params }: DocsArticlePageProps) {
-  if (isPublicContentDisabled()) {
-    return buildDisabledPublicMetadata();
-  }
-
-  const [{ slug }, siteConfig] = await Promise.all([params, getSiteConfig()]);
-  const entry = await getEntry("docs", slug);
-
-  if (!entry) {
-    return buildPublicMetadata({
-      title: siteConfig.collections.docs.title,
-      description: siteConfig.collections.docs.description,
-      path: appRoutes.docsIndex,
-      siteName: siteConfig.siteName,
-    });
-  }
-
-  return buildPublicMetadata({
-    title: entry.seo.title,
-    description: entry.seo.description,
-    path: appRoutes.docsPage(entry.slug),
-    siteName: siteConfig.siteName,
-  });
-}
-
-export default async function DocsArticlePage({ params }: DocsArticlePageProps) {
-  if (isPublicContentDisabled()) {
-    notFound();
-  }
-
-  const [{ slug }, siteConfig] = await Promise.all([params, getSiteConfig()]);
-  const entry = await getEntry("docs", slug);
-
-  if (!entry) {
-    notFound();
-  }
-
+export default function DocsPage() {
   return (
-    <PublicSiteShell activeHref={appRoutes.docsIndex} siteConfig={siteConfig}>
-      <ContentArticle entry={entry} />
-    </PublicSiteShell>
+    <StaticPublicPage
+      eyebrow="Docs"
+      title="Documentation page"
+      body="Helpful context for customer workflows."
+    />
   );
 }

package/assets/templates/next-tenant-app/src/app/docs/page.tsx

@@ -1,51 +1,15 @@
-import { notFound } from "next/navigation";
+import { StaticPublicPage } from "@/features/public-shell/components/static-public-page";
 
-import { ContentCollection } from "@/features/public-shell/components/content-collection";
-import { PublicSiteShell } from "@/features/public-shell/components/public-site-shell";
-import { getSiteConfig, listEntries } from "@/lib/content/adapter.server";
-import { appRoutes } from "@/lib/app-routes";
-import {
-  buildDisabledPublicMetadata,
-  buildPublicMetadata,
-  isPublicContentDisabled,
-} from "@/lib/public-site";
-
-export async function generateMetadata() {
-  if (isPublicContentDisabled()) {
-    return buildDisabledPublicMetadata();
-  }
-
-  const siteConfig = await getSiteConfig();
-  const collection = siteConfig.collections.docs;
-
-  return buildPublicMetadata({
-    title: collection.title,
-    description: collection.description,
-    path: appRoutes.docsIndex,
-    siteName: siteConfig.siteName,
-  });
-}
-
-export default async function DocsIndexPage() {
-  if (isPublicContentDisabled()) {
-    notFound();
-  }
-
-  const [siteConfig, entries] = await Promise.all([
-    getSiteConfig(),
-    listEntries("docs"),
-  ]);
-  const collection = siteConfig.collections.docs;
+export const metadata = {
+  title: "Docs",
+};
 
+export default function DocsIndexPage() {
   return (
-    <PublicSiteShell activeHref={appRoutes.docsIndex} siteConfig={siteConfig}>
-      <ContentCollection
-        description={collection.description}
-        entries={entries}
-        eyebrow={collection.eyebrow}
-        kind="docs"
-        title={collection.title}
-      />
-    </PublicSiteShell>
+    <StaticPublicPage
+      eyebrow="Docs"
+      title="Customer documentation"
+      body="Guides, onboarding notes, and product documentation."
+    />
   );
 }

package/assets/templates/next-tenant-app/src/app/layout.tsx

@@ -5,7 +5,6 @@ import { cookies } from "next/headers";
 import type { ReactNode } from "react";
 
 import { AppProviders } from "./providers";
-import { env } from "@/lib/platform/env.server";
 import { resolvePublicMetadataBase } from "@/lib/public-site";
 import {
   isThemeMode,
@@ -25,22 +24,21 @@ const geistMono = Geist_Mono({
 
 export function generateMetadata(): Metadata {
   const metadataBase = resolvePublicMetadataBase();
+  const appName = process.env.MW_TEMPLATE_APP_NAME || "Tenant App";
 
   return {
     ...(metadataBase ? { metadataBase } : {}),
     title: {
-      default: env.MW_TEMPLATE_APP_NAME,
-      template: `%s | ${env.MW_TEMPLATE_APP_NAME}`,
+      default: appName,
+      template: `%s | ${appName}`,
     },
-    description:
-      "SEO-first public and authenticated Next.js starter with a server-owned platform session BFF.",
+    description: "Customer-facing tenant app.",
     openGraph: {
-      title: env.MW_TEMPLATE_APP_NAME,
-      description:
-        "SEO-first public and authenticated Next.js starter with a server-owned platform session BFF.",
-      siteName: env.MW_TEMPLATE_APP_NAME,
+      title: appName,
+      description: "Customer-facing tenant app.",
+      siteName: appName,
       type: "website",
-      ...(env.MW_PUBLIC_BASE_URL ? { url: env.MW_PUBLIC_BASE_URL } : {}),
+      ...(process.env.MW_PUBLIC_BASE_URL ? { url: process.env.MW_PUBLIC_BASE_URL } : {}),
     },
   };
 }

package/assets/templates/next-tenant-app/src/app/login/page.tsx

@@ -1,33 +1,13 @@
-import { redirect } from "next/navigation";
-
 import { LoginScreen } from "@/features/auth/components/login-screen";
-import { appRoutes } from "@/lib/app-routes";
-import { resolveCurrentSession } from "@/lib/platform/client.server";
-import { platformAuthEndpoints } from "@/lib/platform/endpoints.server";
-import { env } from "@/lib/platform/env.server";
-import { readPlatformAuthState } from "@/lib/platform/session.server";
 
 export const metadata = {
-  title: "Sign In",
-  description:
-    "Authenticate into the combined PandaWork starter to continue into the private workspace surface under /app.",
+  title: "Log In",
   robots: {
     index: false,
     follow: false,
   },
 };
 
-export default async function LoginPage() {
-  const session = await resolveCurrentSession(await readPlatformAuthState());
-
-  if (session.authenticated) {
-    redirect(appRoutes.appHome);
-  }
-
-  return (
-    <LoginScreen
-      appName={env.MW_TEMPLATE_APP_NAME}
-      operatorConsoleHref={platformAuthEndpoints.operatorConsole}
-    />
-  );
+export default function LoginPage() {
+  return <LoginScreen appName={process.env.MW_TEMPLATE_APP_NAME || "Tenant App"} />;
 }