minutework 0.1.40 → 0.1.41

package/assets/templates/vuilder-public-site/src/app/onboarding/[[...step]]/page.tsx

@@ -0,0 +1,39 @@
+import { getSiteManifest } from "@/lib/public-dj.server";
+
+export default async function OnboardingPage({
+  params,
+}: {
+  params: Promise<{ step?: string[] }>;
+}) {
+  const { step = [] } = await params;
+  const manifest = await getSiteManifest();
+
+  return (
+    <main className="site-main">
+      <p className="eyebrow">Onboarding</p>
+      <h1>Start with {manifest.display_name}</h1>
+      <div className="panel">
+        <p>Current step: {step.join("/") || "intake"}</p>
+        <form action="/api/onboarding/start" method="post">
+          <p>
+            <label>
+              Email
+              <br />
+              <input name="email" type="email" required />
+            </label>
+          </p>
+          <p>
+            <label>
+              Name
+              <br />
+              <input name="name" type="text" />
+            </label>
+          </p>
+          <button className="button" type="submit">
+            Continue
+          </button>
+        </form>
+      </div>
+    </main>
+  );
+}

package/assets/templates/vuilder-public-site/src/app/page.tsx

@@ -0,0 +1,43 @@
+import Link from "next/link";
+
+import { appRoutes } from "@/lib/routes";
+import { getHomePageRef, getSiteManifest } from "@/lib/public-dj.server";
+
+export default async function HomePage() {
+  const [manifest, homePage] = await Promise.all([getSiteManifest(), getHomePageRef()]);
+  const headline = String(manifest.payload.metadata.headline ?? manifest.display_name);
+  const summary = String(
+    manifest.payload.metadata.summary ??
+      "A custom Vuilder public site rendered from pinned public-dj content.",
+  );
+
+  return (
+    <div className="site-shell">
+      <header className="site-header">
+        <strong>{manifest.display_name}</strong>
+        <nav>
+          <Link href={appRoutes.blog}>Blog</Link>
+          {" / "}
+          <Link href={appRoutes.onboarding()}>Start</Link>
+        </nav>
+      </header>
+      <main className="site-main">
+        <section className="hero">
+          <p className="eyebrow">{manifest.vertical_slug}</p>
+          <h1>{headline}</h1>
+          <p>{summary}</p>
+          <Link className="button" href={appRoutes.onboarding()}>
+            Start onboarding
+          </Link>
+        </section>
+        <section className="panel">
+          <p>
+            Release manifest: {manifest.content_ref} / {manifest.digest}
+          </p>
+          <p>Home page ref: {homePage?.content_ref ?? "not configured"}</p>
+        </section>
+      </main>
+      <footer className="site-footer">Powered by MinuteWork public-dj CMS.</footer>
+    </div>
+  );
+}

package/assets/templates/vuilder-public-site/src/lib/env.server.ts

@@ -0,0 +1,31 @@
+import "server-only";
+
+import { z } from "zod";
+
+const envSchema = z.object({
+  MW_PUBLIC_DJ_BASE_URL: z.string().url(),
+  MW_AUTH_BASE_URL: z.string().url(),
+  MW_PLATFORM_BASE_URL: z.string().url(),
+  MW_PUBLIC_BASE_URL: z.string().url(),
+  MW_PUBLIC_SITE_PROPERTY_KEY: z.string().min(1),
+  MW_PUBLIC_SITE_ENV: z.enum(["preview", "live"]).default("preview"),
+  MW_PUBLIC_RELEASE_CLASS: z.enum(["static_export", "ssr_container"]).default("ssr_container"),
+  MW_PUBLIC_CONTENT_REF: z.string().min(1),
+  MW_PUBLIC_CONTENT_DIGEST: z.string().min(1),
+  MW_PUBLIC_DJ_READ_TOKEN: z.string().min(1),
+  MW_VUILDER_ONBOARDING_INTENT_TOKEN: z.string().min(1),
+});
+
+export const env = envSchema.parse({
+  MW_PUBLIC_DJ_BASE_URL: process.env.MW_PUBLIC_DJ_BASE_URL,
+  MW_AUTH_BASE_URL: process.env.MW_AUTH_BASE_URL,
+  MW_PLATFORM_BASE_URL: process.env.MW_PLATFORM_BASE_URL,
+  MW_PUBLIC_BASE_URL: process.env.MW_PUBLIC_BASE_URL,
+  MW_PUBLIC_SITE_PROPERTY_KEY: process.env.MW_PUBLIC_SITE_PROPERTY_KEY,
+  MW_PUBLIC_SITE_ENV: process.env.MW_PUBLIC_SITE_ENV,
+  MW_PUBLIC_RELEASE_CLASS: process.env.MW_PUBLIC_RELEASE_CLASS,
+  MW_PUBLIC_CONTENT_REF: process.env.MW_PUBLIC_CONTENT_REF,
+  MW_PUBLIC_CONTENT_DIGEST: process.env.MW_PUBLIC_CONTENT_DIGEST,
+  MW_PUBLIC_DJ_READ_TOKEN: process.env.MW_PUBLIC_DJ_READ_TOKEN,
+  MW_VUILDER_ONBOARDING_INTENT_TOKEN: process.env.MW_VUILDER_ONBOARDING_INTENT_TOKEN,
+});

package/assets/templates/vuilder-public-site/src/lib/platform.server.ts

@@ -0,0 +1,47 @@
+import "server-only";
+
+import { env } from "@/lib/env.server";
+import { getSiteManifest } from "@/lib/public-dj.server";
+
+export async function createCustomerVerticalSignupIntent(input: {
+  email?: string;
+  name?: string;
+  answers?: Record<string, unknown>;
+}) {
+  const manifest = await getSiteManifest();
+  const url = new URL("/api/v1/vuilder/onboarding-intents/", env.MW_PLATFORM_BASE_URL);
+  const response = await fetch(url.toString(), {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${env.MW_VUILDER_ONBOARDING_INTENT_TOKEN}`,
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({
+      kind: "customer_vertical_signup",
+      source: "vuilder_public_site",
+      vuilder_workspace_external_key: String(
+        manifest.payload.metadata.vuilder_workspace_external_key ?? "",
+      ),
+      property_key: env.MW_PUBLIC_SITE_PROPERTY_KEY,
+      site_release_key: String(manifest.payload.metadata.site_release_key ?? ""),
+      public_site_manifest_ref: manifest.content_ref,
+      public_site_manifest_digest: manifest.digest,
+      vertical_package_ref: manifest.payload.vertical_package?.content_ref ?? "",
+      vertical_package_digest: manifest.payload.vertical_package?.digest ?? "",
+      onboarding_flow_ref: manifest.payload.onboarding_flow?.content_ref ?? "",
+      onboarding_flow_digest: manifest.payload.onboarding_flow?.digest ?? "",
+      intake_payload: {
+        email: input.email ?? "",
+        name: input.name ?? "",
+        answers: input.answers ?? {},
+      },
+    }),
+  });
+
+  if (!response.ok) {
+    throw new Error(`Unable to create onboarding intent (${response.status}).`);
+  }
+
+  return response.json();
+}

package/assets/templates/vuilder-public-site/src/lib/public-dj.server.ts

@@ -0,0 +1,86 @@
+import "server-only";
+
+import { cache } from "react";
+import { z } from "zod";
+
+import { env } from "@/lib/env.server";
+
+const refDigestSchema = z.object({
+  content_ref: z.string().min(1),
+  digest: z.string().min(1),
+});
+
+const marketplacePackageRefSchema = z
+  .string()
+  .min(1)
+  .regex(/^core:app_pack_catalog:[^:]+:[^:]+:[^:]+$/);
+
+const verticalPackageRefDigestSchema = refDigestSchema.extend({
+  content_ref: marketplacePackageRefSchema,
+});
+
+const siteManifestSchema = z.object({
+  content_ref: z.string(),
+  digest: z.string(),
+  content_kind: z.literal("public_site_manifest"),
+  vertical_key: z.string(),
+  vertical_slug: z.string(),
+  property_key: z.string(),
+  display_name: z.string(),
+  payload: z.object({
+    pages: z.array(
+      refDigestSchema.extend({
+        page_key: z.string(),
+        path: z.string(),
+      }),
+    ),
+    blog_posts: z.array(refDigestSchema).default([]),
+    onboarding_flow: refDigestSchema.nullable().optional(),
+    vertical_package: verticalPackageRefDigestSchema.nullable().optional(),
+    navigation: z.array(z.unknown()).default([]),
+    media: z.array(z.unknown()).default([]),
+    theme_tokens: z.record(z.unknown()).default({}),
+    metadata: z.record(z.unknown()).default({}),
+  }),
+});
+
+export type PublicSiteManifest = z.infer<typeof siteManifestSchema>;
+
+async function resolvePublicContent(contentRef: string, digest: string) {
+  const url = new URL("/api/v1/content/resolve/", env.MW_PUBLIC_DJ_BASE_URL);
+  url.searchParams.set("content_ref", contentRef);
+  url.searchParams.set("digest", digest);
+  const response = await fetch(url.toString(), {
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${env.MW_PUBLIC_DJ_READ_TOKEN}`,
+    },
+    next: {
+      revalidate: env.MW_PUBLIC_SITE_ENV === "live" ? 300 : 0,
+      tags: ["vuilder-public-site", env.MW_PUBLIC_SITE_PROPERTY_KEY],
+    },
+  });
+
+  if (!response.ok) {
+    throw new Error(`Unable to resolve public-dj content (${response.status}).`);
+  }
+
+  return response.json();
+}
+
+export const getSiteManifest = cache(async (): Promise<PublicSiteManifest> => {
+  const payload = await resolvePublicContent(
+    env.MW_PUBLIC_CONTENT_REF,
+    env.MW_PUBLIC_CONTENT_DIGEST,
+  );
+  return siteManifestSchema.parse(payload);
+});
+
+export async function getHomePageRef() {
+  const manifest = await getSiteManifest();
+  return (
+    manifest.payload.pages.find((page) => page.path === "/") ??
+    manifest.payload.pages[0] ??
+    null
+  );
+}

package/assets/templates/vuilder-public-site/src/lib/public-dj.test.ts

@@ -0,0 +1,8 @@
+import { describe, expect, it } from "vitest";
+
+describe("public-dj template contract", () => {
+  it("uses public site manifest refs instead of storing component code in env", () => {
+    expect("MW_PUBLIC_CONTENT_REF").toContain("CONTENT_REF");
+    expect("MW_PUBLIC_CONTENT_DIGEST").toContain("DIGEST");
+  });
+});

package/assets/templates/vuilder-public-site/src/lib/routes.test.ts

@@ -0,0 +1,13 @@
+import { describe, expect, it } from "vitest";
+
+import { appRoutes } from "@/lib/routes";
+
+describe("vuilder public site routes", () => {
+  it("declares public website and onboarding routes only", () => {
+    expect(appRoutes.home).toBe("/");
+    expect(appRoutes.blog).toBe("/blog");
+    expect(appRoutes.onboarding()).toBe("/onboarding");
+    expect(Object.values(appRoutes).join(" ")).not.toContain("/w/");
+    expect(Object.values(appRoutes).join(" ")).not.toContain("/app");
+  });
+});

package/assets/templates/vuilder-public-site/src/lib/routes.ts

@@ -0,0 +1,12 @@
+import type { Route } from "next";
+
+export const appRoutes = {
+  home: "/" as Route,
+  blog: "/blog" as Route,
+  blogPost(slug: string) {
+    return `/blog/${encodeURIComponent(slug)}` as Route;
+  },
+  onboarding(step = "") {
+    return step ? (`/onboarding/${encodeURIComponent(step)}` as Route) : ("/onboarding" as Route);
+  },
+};

package/assets/templates/vuilder-public-site/template.json

@@ -0,0 +1,21 @@
+{
+  "template_id": "vuilder-public-site",
+  "template_kind": "public_site",
+  "template_profile": "public_dj_cms",
+  "template_bundle_ref": "runtime/builder/templates/vuilder-public-site",
+  "template_version": "0.1.0",
+  "materialize": {
+    "destination": "app"
+  },
+  "builder_edit_mode": "workspace_copy_only",
+  "seed_source": "runtime/builder/templates/vuilder-public-site",
+  "required_bootstrap_steps": [
+    "next_typegen"
+  ],
+  "runtime_contract_refs": [
+    "reference/mwv3-dj6-docs/published_web_property_contract.md",
+    "reference/mwv3-dj6-docs/runtime_app_deployment_and_provisioning_contract.md",
+    "reference/mwv3-dj6-docs/auth_and_credential_contract.md"
+  ],
+  "example_features": {}
+}

package/assets/templates/vuilder-public-site/tools/template/validate-template.mjs

@@ -0,0 +1,44 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const templateRoot = path.resolve(__dirname, "..", "..");
+const manifestPath = path.join(templateRoot, "template.json");
+const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+
+const requiredFields = [
+  "template_id",
+  "template_kind",
+  "template_profile",
+  "template_version",
+  "materialize",
+  "builder_edit_mode",
+  "seed_source",
+  "required_bootstrap_steps",
+  "example_features",
+];
+
+for (const field of requiredFields) {
+  if (!(field in manifest)) {
+    throw new Error(`template.json is missing required field "${field}"`);
+  }
+}
+
+if (manifest.template_id !== "vuilder-public-site") {
+  throw new Error("template_id must be vuilder-public-site");
+}
+
+if (manifest.template_kind !== "public_site") {
+  throw new Error("template_kind must be public_site");
+}
+
+if (manifest.template_profile !== "public_dj_cms") {
+  throw new Error("template_profile must be public_dj_cms");
+}
+
+if (manifest.materialize?.destination !== "app") {
+  throw new Error("vuilder-public-site must materialize to app");
+}
+
+console.log("template.json is valid");

package/assets/templates/vuilder-public-site/tsconfig.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "target": "ES2017",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": false,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [{ "name": "next" }],
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}

package/assets/templates/vuilder-public-site/vitest.config.ts

@@ -0,0 +1,13 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    environment: "node",
+    globals: true,
+  },
+  resolve: {
+    alias: {
+      "@": new URL("./src", import.meta.url).pathname,
+    },
+  },
+});

package/assets/templates/vuilder-shell/.env.example

@@ -0,0 +1,8 @@
+NEXT_PUBLIC_MW_APP_ID=vuilder.vertical
+MW_TEMPLATE_APP_NAME=Vuilder Shell
+MW_PUBLIC_BASE_URL=http://127.0.0.1:3301
+MW_AUTH_BASE_URL=http://127.0.0.1:3400
+MW_PUBLIC_SITE_PROPERTY_KEY=vuilder-shell
+MW_PUBLIC_SITE_ENV=preview
+MW_PLATFORM_BASE_URL=http://127.0.0.1:8000
+MW_PLATFORM_FETCH_TIMEOUT_MS=15000

package/assets/templates/vuilder-shell/.storybook/main.ts

@@ -0,0 +1,19 @@
+import { defineMain } from "@storybook/nextjs-vite/node";
+
+export default defineMain({
+  stories: [
+    "../src/design-system/**/*.stories.@(ts|tsx|mdx)",
+    "../src/design-system/docs/**/*.mdx",
+  ],
+  addons: ["@storybook/addon-docs", "@storybook/addon-a11y"],
+  framework: {
+    name: "@storybook/nextjs-vite",
+    options: {
+      nextConfigPath: "../next.config.mjs",
+    },
+  },
+  staticDirs: ["../public"],
+  docs: {
+    defaultName: "Overview",
+  },
+});

package/assets/templates/vuilder-shell/.storybook/preview.tsx

@@ -0,0 +1,38 @@
+import { definePreview } from "@storybook/nextjs-vite";
+
+import "../src/app/globals.css";
+import { ThemeProvider } from "../src/lib/theme";
+
+export default definePreview({
+  decorators: [
+    (Story) => (
+      <ThemeProvider
+        attribute="class"
+        defaultTheme="light"
+        enableSystem
+        disableTransitionOnChange
+      >
+        <div className="min-h-screen bg-background p-6 text-foreground">
+          <Story />
+        </div>
+      </ThemeProvider>
+    ),
+  ],
+  parameters: {
+    layout: "centered",
+    nextjs: {
+      appDirectory: true,
+    },
+    controls: {
+      matchers: {
+        color: /(background|color)$/i,
+        date: /Date$/i,
+      },
+    },
+    options: {
+      storySort: {
+        order: ["Design System"],
+      },
+    },
+  },
+});

package/assets/templates/vuilder-shell/README.md

@@ -0,0 +1,49 @@
+# Vuilder Shell Template
+
+`vuilder-shell` is the branded customer tenant shell for Vuilder-owned verticals.
+It is generated next to `vuilder-app` in a Vuilder workspace.
+
+The shell opens after the customer has signed in through central SSO and the
+platform has completed the `customer_vertical_signup` intent. The platform owns
+identity, tenant runtime provisioning, and app-pack install authority. This
+template owns customer-visible navigation, workspace status, and vertical
+product UI.
+
+## Route Shape
+
+- public route at `/`
+- platform member auth handoff at `/login`, which redirects to central SSO with
+  a shell return URL
+- branded tenant setup/status route at `/w/[workspace_slug]/connect`
+- branded tenant workspace route at `/w/[workspace_slug]`
+- compatibility authenticated app route at `/app`
+
+## Auth Profile
+
+This template uses central platform SSO plus a tenant-bound shell session minted
+by the platform after membership is established. `/login` sets a short-lived
+host-only shell handoff state cookie before redirecting to SSO. SSO returns to
+`/api/auth/accept-shell-session` with a short-lived one-use code and the echoed
+state; the shell validates the state, exchanges the code server-side, sets a
+host-only `mw_vuilder_shell_session` cookie, and redirects to the clean
+workspace URL. Raw platform session and CSRF cookies stay on the SSO origin; the
+shell never builds Django session or CSRF headers. The shell does not render a
+password form and does not expose a local credential-login BFF; `/login` is only
+an SSO redirect handoff. Local `/api/auth/session` and `/api/auth/logout` are
+thin shell-token helpers; logout best-effort revokes the tenant-bound shell
+token before clearing cookies. Browser React never stores platform credentials,
+runtime keys, provisioning secrets, package refs, or install coordinates.
+
+For production handoff from `auth.*` to a branded shell on a sibling subdomain,
+configure `MW_AUTH_BASE_URL` and `MW_PUBLIC_BASE_URL`. Do not configure a shared
+parent-domain shell cookie; the shell session cookie is host-only on the branded
+shell origin.
+
+`vuilder-shell` is not a `tenant-app` and must not use `@minutework/web-auth`
+or same-origin `/_mw` customer routes.
+
+## Vuilder Boundary
+
+Vuilders may customize UI, route layout, visual design, tenant settings,
+runtime-backed data views, agents, workflows, and branding. They must not move
+provisioning decisions into React state or browser-submitted payloads.

package/assets/templates/vuilder-shell/components.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "new-york",
+  "rsc": true,
+  "tsx": true,
+  "tailwind": {
+    "config": "",
+    "css": "src/app/globals.css",
+    "baseColor": "neutral",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "aliases": {
+    "components": "@/design-system",
+    "utils": "@/lib/utils",
+    "ui": "@/design-system/primitives",
+    "lib": "@/lib",
+    "hooks": "@/hooks"
+  },
+  "iconLibrary": "lucide"
+}

package/assets/templates/vuilder-shell/eslint.config.mjs

@@ -0,0 +1,41 @@
+import nextCoreWebVitals from "eslint-config-next/core-web-vitals";
+import nextTypeScript from "eslint-config-next/typescript";
+
+import designSystemPlugin from "./tools/design-system/eslint-plugin-design-system.mjs";
+
+const eslintConfig = [
+  ...nextCoreWebVitals,
+  ...nextTypeScript,
+  {
+    ignores: [
+      ".next/**",
+      "node_modules/**",
+      "next-env.d.ts",
+      "storybook-static/**",
+      "src/design-system/tokens/manifest.ts",
+    ],
+  },
+  {
+    files: ["src/app/**/*.{ts,tsx}", "src/features/**/*.{ts,tsx}"],
+    plugins: {
+      "design-system": designSystemPlugin,
+    },
+    rules: {
+      "design-system/no-design-system-bypass-imports": "error",
+      "design-system/no-cva-outside-design-system": "error",
+      "design-system/no-raw-design-values": "error",
+      "design-system/no-bespoke-visual-stacks-in-features": "error",
+    },
+  },
+  {
+    files: ["src/design-system/**/*.{ts,tsx}"],
+    plugins: {
+      "design-system": designSystemPlugin,
+    },
+    rules: {
+      "design-system/no-raw-design-values": "error",
+    },
+  },
+];
+
+export default eslintConfig;

package/assets/templates/vuilder-shell/next-env.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

package/assets/templates/vuilder-shell/next.config.mjs

@@ -0,0 +1,33 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { existsSync } from "node:fs";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+function resolveTurbopackRoot(startDirectory) {
+  let directory = startDirectory;
+
+  while (true) {
+    if (existsSync(path.join(directory, "pnpm-workspace.yaml"))) {
+      return directory;
+    }
+
+    const parent = path.dirname(directory);
+    if (parent === directory) {
+      return startDirectory;
+    }
+    directory = parent;
+  }
+}
+
+const nextConfig = {
+  reactStrictMode: true,
+  typedRoutes: true,
+  // Prefer the nearest workspace root so scaffolded tenant-app packages inside a
+  // monorepo and the in-repo template both resolve dependencies correctly.
+  turbopack: {
+    root: resolveTurbopackRoot(__dirname),
+  },
+};
+
+export default nextConfig;