create-ailk 0.11.1 → 0.11.2

package/templates/apps/api/src/routes/checkout/__tests__/sessions.test.ts

@@ -91,7 +91,10 @@ import { checkoutRoutes } from "../index";
 // #6877 — pin the suite's site origin to the fixtures' own origin, so every
 // anonymous case below sends same-origin redirects. Runs before any
 // `describe` is collected, so the #6866 block's SAME_ORIGIN reads it too.
+// #7395 — the redirect lock and the buyer's cookie check read the trusted
+// allowlist, not FRONTEND_URL, so the suite pins both.
 config.FRONTEND_URL = "https://example.com";
+config.TRUSTED_ORIGINS = ["https://example.com"];
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -1298,6 +1301,7 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
   beforeEach(async () => {
     jest.clearAllMocks();
     config.FRONTEND_URL = SITE_ORIGIN;
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
     process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
     delete process.env["OSS_API_INTERNAL_SECRET"];
     mockAssertSandboxKey.mockImplementation(() => undefined);
@@ -1328,6 +1332,7 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
     delete process.env["STRIPE_SECRET_KEY"];
     delete process.env["OSS_API_INTERNAL_SECRET"];
     config.FRONTEND_URL = SITE_ORIGIN;
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
     if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
     else process.env.DATABASE_URL = originalDatabaseUrl;
   });
@@ -1453,45 +1458,24 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
     expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
   });
 
-  it.each([
-    [
-      "an unparseable FRONTEND_URL",
-      () => {
-        config.FRONTEND_URL = "not a url";
-      },
-    ],
-    [
-      "a non-http(s) FRONTEND_URL",
-      () => {
-        config.FRONTEND_URL = "mailto:ops@example.com";
-      },
-    ],
-    [
-      "an unset FRONTEND_URL in production",
-      () => {
-        delete process.env.FRONTEND_URL;
-        config.NODE_ENV = "production";
-      },
-    ],
-  ])(
-    "#6877 R8: %s answers 500 config-error with no Stripe call",
-    async (_label, arrange) => {
-      const envFrontendUrl = process.env.FRONTEND_URL;
-      const nodeEnv = config.NODE_ENV;
-      try {
-        arrange();
-        const res = await post(VALID_BODY);
-
-        expect(res.statusCode).toBe(500);
-        expect(res.json()).toEqual({ error: "config-error" });
-        expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-      } finally {
-        config.FRONTEND_URL = SITE_ORIGIN;
-        config.NODE_ENV = nodeEnv;
-        process.env.FRONTEND_URL = envFrontendUrl;
-      }
-    },
-  );
+  // #7395 D4 — what an unusable or unset FRONTEND_URL did here before
+  // (#6877 R8) is now an empty trusted list: config resolves both to `[]`
+  // (config/__tests__/trusted-origins.test.ts), and the route answers the
+  // same 500.
+  it("#6877 R8: an empty trusted-origin list answers 500 config-error with no Stripe call", async () => {
+    config.TRUSTED_ORIGINS = [];
+
+    const res = await post(VALID_BODY);
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "config-error" });
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+    expect(
+      logLines.some(
+        (l) => l["msg"] === "[checkout] no trusted browser origin is configured",
+      ),
+    ).toBe(true);
+  });
 
   it("#6877 R9: a refused request never reads the session cookie's row", async () => {
     process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
@@ -1514,3 +1498,148 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
     expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
   });
 });
+
+// ── Trusted-origin allowlist (#7395) ──────────────────────────────────────────
+
+describe("POST /v1/checkout/sessions — trusted-origin allowlist (#7395)", () => {
+  const SITE_ORIGIN = "https://example.com";
+  const SPOKE_A = "https://spoke-a.example";
+  const SESSION_TOKEN = "sess_tok_7395";
+  const COOKIE = `better-auth.session_token=${SESSION_TOKEN}.signature`;
+  const originalDatabaseUrl = process.env.DATABASE_URL;
+
+  let app: FastifyInstance;
+
+  function post(
+    payload: Record<string, unknown>,
+    headers: Record<string, string> = {},
+  ) {
+    return app.inject({
+      method: "POST",
+      url: "/v1/checkout/sessions",
+      headers,
+      payload,
+    });
+  }
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN, SPOKE_A];
+    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
+    delete process.env["OSS_API_INTERNAL_SECRET"];
+    mockAssertSandboxKey.mockImplementation(() => undefined);
+    mockCreateCheckoutSession.mockResolvedValue({
+      sessionId: "cs_test_allow7395",
+      url: "https://checkout.stripe.com/c/pay/cs_test_allow7395",
+    });
+
+    app = buildApp();
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    await app.close();
+    delete process.env["STRIPE_SECRET_KEY"];
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
+    (prisma.session.findUnique as jest.Mock).mockReset();
+    (prisma.user.findUnique as jest.Mock).mockReset();
+    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
+    else process.env.DATABASE_URL = originalDatabaseUrl;
+  });
+
+  it("accepts an anonymous checkout with both redirects on a listed spoke", async () => {
+    const successUrl = `${SPOKE_A}/purchase/success`;
+    const cancelUrl = `${SPOKE_A}/purchase/cancel`;
+
+    const res = await post({ productCode: "ailk-pro", successUrl, cancelUrl });
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
+      expect.objectContaining({ successUrl, cancelUrl }),
+    );
+  });
+
+  it("accepts redirects split across two listed origins", async () => {
+    const successUrl = `${SPOKE_A}/purchase/success`;
+    const cancelUrl = `${SITE_ORIGIN}/pricing`;
+
+    const res = await post({ productCode: "ailk-pro", successUrl, cancelUrl });
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
+      expect.objectContaining({ successUrl, cancelUrl }),
+    );
+  });
+
+  it.each([
+    ["successUrl", "https://spoke-b.example/x"],
+    ["successUrl", "https://spoke-a.example.evil.test/x"],
+    ["cancelUrl", "https://spoke-b.example/x"],
+    ["cancelUrl", "https://spoke-a.example.evil.test/x"],
+  ])(
+    "refuses a %s on the unlisted %j with 400 naming the field and no Stripe call",
+    async (field, url) => {
+      const res = await post({ ...VALID_BODY, [field]: url });
+
+      expect(res.statusCode).toBe(400);
+      const body = res.json();
+      expect(body.error).toBe("validation-error");
+      expect(body.details).toHaveLength(1);
+      expect(body.details[0].path).toEqual([field]);
+      expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+    },
+  );
+
+  it("answers 500 config-error with no Stripe call when the list is empty", async () => {
+    config.TRUSTED_ORIGINS = [];
+
+    const res = await post({
+      ...VALID_BODY,
+      successUrl: `${SPOKE_A}/purchase/success`,
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "config-error" });
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it("signs the buyer in for a valid cookie forwarded with a listed spoke's Origin", async () => {
+    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      id: "ses_1",
+      userId: "usr_buyer",
+      expiresAt: new Date(Date.now() + 60_000),
+      activeOrganizationId: null,
+      activeWorkspaceId: null,
+    });
+    (prisma.user.findUnique as jest.Mock).mockImplementation(
+      async (args: { select: Record<string, boolean> }) => {
+        const row: Record<string, unknown> = {
+          id: "usr_buyer",
+          email: "buyer@example.com",
+          emailVerified: true,
+          billingProvider: null,
+          billingCustomerId: null,
+        };
+        return Object.fromEntries(
+          Object.keys(args.select).map((k) => [k, row[k]]),
+        );
+      },
+    );
+
+    const res = await post(
+      {
+        productCode: "ailk-pro",
+        successUrl: `${SPOKE_A}/purchase/success`,
+        cancelUrl: `${SPOKE_A}/purchase/cancel`,
+      },
+      { cookie: COOKIE, origin: SPOKE_A },
+    );
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession.mock.calls[0][0].buyer).toEqual({
+      userId: "usr_buyer",
+      email: "buyer@example.com",
+    });
+  });
+});

package/templates/apps/api/src/routes/checkout/sessions.ts

@@ -28,13 +28,14 @@
  *     (backward-compat for OSS standalone deployments). See #935.
  *   - Same-origin redirects (#6877): a request that did not pass an ENABLED
  *     internal-auth gate (the OSS default) must send successUrl and cancelUrl
- *     on the site's own origin — `FRONTEND_URL`'s, exact scheme + host + port,
- *     checked on the raw string as well as on the parse, because the raw
- *     string is what Stripe receives. Anything else is a 400 before any Stripe
- *     call or database read. A caller authenticated by X-Internal-Auth keeps
- *     its redirects; that exemption holds only while every internal caller
- *     builds its redirects itself — an internal caller MUST NEVER forward a
- *     redirect taken from its own end user.
+ *     each on one of the trusted browser origins — `config.TRUSTED_ORIGINS`
+ *     (#7395: FRONTEND_URL's origin plus AILK_TRUSTED_ORIGINS), exact scheme +
+ *     host + port, checked on the raw string as well as on the parse, because
+ *     the raw string is what Stripe receives. Anything else is a 400 before
+ *     any Stripe call or database read. A caller authenticated by
+ *     X-Internal-Auth keeps its redirects; that exemption holds only while
+ *     every internal caller builds its redirects itself — an internal caller
+ *     MUST NEVER forward a redirect taken from its own end user.
  *
  * Error mapping:
  *   401 internal-auth-required — X-Internal-Auth missing/mismatch (only when env var set)
@@ -44,8 +45,8 @@
  *   500 stripe-not-configured — STRIPE_SECRET_KEY is missing/empty (no Stripe call)
  *   500 live-mode-forbidden   — STRIPE_SECRET_KEY is a live key
  *   500 config-error          — STRIPE_SECRET_KEY invalid configuration (from the SDK wrapper),
- *                               or FRONTEND_URL is not an absolute http(s) URL / is unset in
- *                               production when the origin lock applies (#6877)
+ *                               or no trusted browser origin is configured when the origin
+ *                               lock applies (#6877, #7395)
  *   502 checkout-unavailable  — Stripe SDK threw an unexpected error
  */
 import { timingSafeEqual } from "node:crypto";
@@ -154,26 +155,6 @@ function internalAuthVerdict(
 
 // ── Same-origin redirect lock (#6877) ────────────────────────────────────────
 
-/**
- * The site's own origin, from `FRONTEND_URL` (#6877 D6). `null` when the
- * setting does not parse, parses to a non-http(s) scheme (whose origin would
- * be the literal `"null"`), or is unset in production — where the config
- * default `http://localhost:3000` would lock a live site to localhost.
- */
-function siteRedirectOrigin(): string | null {
-  if (!process.env["FRONTEND_URL"] && config.NODE_ENV === "production") {
-    return null;
-  }
-  let parsed: URL;
-  try {
-    parsed = new URL(config.FRONTEND_URL);
-  } catch {
-    return null;
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
-  return parsed.origin;
-}
-
 /** C0 controls, space, DEL and backslash — anything a parser may normalize. */
 // eslint-disable-next-line no-control-regex -- the control-character range is exactly what D2 check 1 must refuse.
 const NON_CANONICAL_URL_CHAR = /[\u0000-\u0020\u007f\\]/;
@@ -225,7 +206,7 @@ async function resolveBuyer(
   request: FastifyRequest,
 ): Promise<{ buyer?: Buyer; identity?: IdentityReason }> {
   const cookieUser = await resolveOptionalCookieUser(request, {
-    frontendOrigin: config.FRONTEND_URL,
+    trustedOrigins: config.TRUSTED_ORIGINS,
   });
   if (cookieUser.kind === "none") {
     return cookieUser.reason === "no_cookie"
@@ -279,16 +260,21 @@ export async function checkoutSessionsHandler(
 
   // ── Same-origin redirect lock (#6877) — before any Stripe or DB call ──────
   if (authVerdict === "open") {
-    const siteOrigin = siteRedirectOrigin();
-    if (siteOrigin === null) {
+    // An empty list is FRONTEND_URL unset in production or unusable, with no
+    // AILK_TRUSTED_ORIGINS (#7395 D4) — refused before any Stripe or DB call.
+    const trustedOrigins = config.TRUSTED_ORIGINS;
+    if (trustedOrigins.length === 0) {
       request.log.error(
         { method: request.method, path: request.url },
-        "[checkout] FRONTEND_URL is not a valid absolute URL",
+        "[checkout] no trusted browser origin is configured",
       );
       return reply.status(500).send({ error: "config-error" });
     }
     const refused = (["successUrl", "cancelUrl"] as const).filter(
-      (field) => !isSameOriginRedirect(parsed.data[field], siteOrigin),
+      (field) =>
+        !trustedOrigins.some((origin) =>
+          isSameOriginRedirect(parsed.data[field], origin),
+        ),
     );
     if (refused.length > 0) {
       // Field names only — the refused URL is never logged or echoed.

package/templates/apps/api/src/routes/project-listings/__tests__/me.test.ts

@@ -267,7 +267,7 @@ function installFixtureMocks(): void {
 async function buildApp(): Promise<FastifyInstance> {
   const app = Fastify();
   await app.register(async (authScope) => {
-    await authScope.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+    await authScope.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
     await authScope.register(projectListingMeRoute);
   });
   await app.ready();

package/templates/apps/api/src/server.ts

@@ -512,18 +512,19 @@ async function assertCommerceSandboxKey(key: string): Promise<void> {
  * #6889 (SEC-02 of the #6876 security review) — make the checkout route's
  * posture observable. POST /v1/checkout/sessions admits a caller without
  * X-Internal-Auth when OSS_API_INTERNAL_SECRET is unset. With FRONTEND_URL
- * unset, the route's same-origin redirect lock (#6877) answers 500
- * config-error to that caller, and the CORS and cookie-CSRF origin checks pin
- * to the `http://localhost:3000` config default. Both stay optional (OSS
- * standalone compat), so this only ever WARNS — once per unset variable, and
- * only in production. FRONTEND_URL is read from the raw environment because
- * `config.FRONTEND_URL` carries that localhost default.
+ * unset in production, the trusted-origin list (#7395) holds only
+ * AILK_TRUSTED_ORIGINS — with that unset too, CORS and cookie writes refuse
+ * every browser origin and the redirect lock (#6877) answers 500
+ * config-error to that caller. Both stay optional (OSS standalone compat), so
+ * this only ever WARNS — once per unset variable, and only in production.
+ * FRONTEND_URL is read from the raw environment because `config.FRONTEND_URL`
+ * carries a localhost default.
  */
 function warnOnUnsetProductionProtections(): void {
   if (config.NODE_ENV !== "production") return;
   if (!process.env["FRONTEND_URL"]) {
     logger.warn(
-      "[startup] FRONTEND_URL not set in production — CORS/cookie origin checks are pinned to http://localhost:3000, and checkout answers 500 config-error to any caller admitted without X-Internal-Auth",
+      "[startup] FRONTEND_URL not set in production — CORS, cookie-authenticated writes and checkout redirects trust only AILK_TRUSTED_ORIGINS; with neither set, all three refuse every browser origin and checkout answers 500 config-error to any caller admitted without X-Internal-Auth",
     );
   }
   if (!process.env["OSS_API_INTERNAL_SECRET"]) {
@@ -645,12 +646,16 @@ export async function build() {
   // never reach the client. Full detail still goes to pino at error level.
   registerErrorSerializer(server);
 
-  // Register CORS — public read API + same-origin auth callers.
-  // With FRONTEND_URL unset: reflect any origin in dev/test (zero-config
-  // boot) but fail CLOSED in production — `origin: true` combined with
-  // `credentials: true` would let any website read credentialed responses
-  // (security review M1). `false` disables cross-origin access entirely;
-  // same-origin and non-browser callers are unaffected.
+  // Register CORS — public read API + the trusted browser origins (#7395).
+  // `origin` is ALWAYS a copy of `config.TRUSTED_ORIGINS`, the frozen list
+  // config/index.ts resolves once at startup from FRONTEND_URL and
+  // AILK_TRUSTED_ORIGINS (no `*`, no wildcard host). @fastify/cors echoes a
+  // request's Origin only on an exact match against that array, and writes no
+  // allow-origin header otherwise; an empty list means no cross-origin caller.
+  // Never pass `true`, a function, a RegExp or a delegator here, and never set
+  // a per-route `cors` option: with `credentials: true`, reflecting any origin
+  // would let any website read credentialed responses (security review M1).
+  // Same-origin and non-browser callers are unaffected.
   //
   // `methods` is EXPLICIT because @fastify/cors defaults it to `GET,HEAD,POST`
   // (its own `defaultOptions`), which is narrower than the surface this server
@@ -666,7 +671,7 @@ export async function build() {
   // live route table on every run, so a route added in a NEW method fails there
   // rather than silently becoming unreachable from a browser.
   //
-  // This widens WHICH METHODS the allowed origin may use, never WHO is allowed:
+  // This widens WHICH METHODS the allowed origins may use, never WHO is allowed:
   // `origin` and `credentials` are untouched.
   //
   // `allowedHeaders` is deliberately left unset: null means @fastify/cors
@@ -674,7 +679,7 @@ export async function build() {
   // and `content-type` pass without this file having to maintain a list that
   // silently drops a header a future route needs.
   await server.register(cors, {
-    origin: config.FRONTEND_URL || config.NODE_ENV !== "production",
+    origin: [...config.TRUSTED_ORIGINS],
     credentials: true,
     methods: ["GET", "HEAD", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
   });
@@ -726,7 +731,7 @@ export async function build() {
   // handlers. Cookie-first, Bearer-fallback; see middleware/auth.ts.
   await server.register(async (authScope) => {
     await authScope.register(authPreHandlerPlugin, {
-      frontendOrigin: config.FRONTEND_URL,
+      trustedOrigins: config.TRUSTED_ORIGINS,
     });
     await authScope.register(tokenRoutes);
     await authScope.register(userRoutes);

package/templates/apps/web/app/[locale]/layout.tsx

@@ -48,7 +48,10 @@ import type { ReactElement, ReactNode } from "react";
 
 import { auth } from "../../auth";
 import { GoogleAnalytics } from "../../components/google-analytics";
-import { SignOutTrigger } from "../../components/sign-out-trigger";
+import {
+  SignedInNav,
+  type SignedInNavProps,
+} from "../../components/signed-in-nav";
 import { isAuthPath } from "../../lib/auth-routes";
 import { assertEnabledLocale } from "../../lib/locale-guard";
 import { footerColumns, navItems } from "../../lib/nav-config";
@@ -83,10 +86,11 @@ type ThemeMode = "light" | "dark";
  * and `flow` (open a StepFlow lightbox). The `flow` kind + Nav's
  * `renderFlowTrigger` composer is Nav's ONE caller-composed seam (#4341): the
  * caller receives the rendered trigger `<Button>` and decides what wraps it.
- * The layout uses that seam WITHOUT a lightbox — `renderFlowTrigger` below
- * replaces both signed-in triggers (Account → a non-navigating name label,
- * Sign out → `SignOutTrigger`), so this flow config is NEVER rendered. It only
- * has to satisfy the type: one minimal fields-step and a dead `action`.
+ * The layout uses that seam WITHOUT a lightbox — `SignedInNav`'s
+ * `renderFlowTrigger` replaces both signed-in triggers (Account → a
+ * non-navigating name label, Sign out → `SignOutTrigger`), so this flow config
+ * is NEVER rendered. It only has to satisfy the type: one minimal fields-step
+ * and a dead `action`.
  */
 const NAV_CLIENT_ACTION_FLOW: NavActionFlow["flow"] = {
   steps: [
@@ -314,7 +318,8 @@ export default async function LocaleLayout({
   // the service shapes now roster both). Signed in → the user's name (a
   // non-navigating label) + an outline-strong "Sign out"; both authored as
   // `kind: "flow"` so Nav hands their triggers back through
-  // `renderFlowTrigger` (see NAV_CLIENT_ACTION_FLOW above).
+  // `renderFlowTrigger`, which `SignedInNav` owns (see NAV_CLIENT_ACTION_FLOW
+  // above).
   const navActions: NavAction[] = session
     ? [
         { labelKey: "account", kind: "flow", flow: NAV_CLIENT_ACTION_FLOW },
@@ -331,15 +336,17 @@ export default async function LocaleLayout({
         { labelKey: "signUp", path: "/sign-up", variant: "primary" },
       ];
 
-  // Only compose the flow seam when there is a flow action to compose. This
-  // layout is a Server Component and `renderFlowTrigger` is a function, so
-  // passing it is only legal when Nav actually consumes it here rather than
-  // forwarding it across the RSC boundary into NavMobileMenu ("use client").
-  // Passing it unconditionally crashed EVERY signed-out render — the whole of a
-  // fresh scaffold, which configures no auth provider — with "Functions cannot
-  // be passed directly to Client Components". Nav itself already guards its own
-  // forward the same way (chrome/Nav.tsx: `{...(renderFlowTrigger ? … : {})}`);
-  // this is the caller half of that contract.
+  // A flow action needs `renderFlowTrigger`, a function — and this layout is a
+  // Server Component. Nav forwards that function into NavMobileMenu ("use
+  // client"), and React cannot serialize a function across the RSC boundary:
+  // passing it from here crashed EVERY signed-in page with "Functions cannot be
+  // passed directly to Client Components" (#7402). Nav's own
+  // `{...(renderFlowTrigger ? … : {})}` guard only skips the forward when the
+  // function is undefined; it never makes passing one legal. So a flow action
+  // routes the whole Nav through `SignedInNav` ("use client"), which defines
+  // `renderFlowTrigger` and imports `navItems` (icon components are functions
+  // too) on the client side. Without one, Nav stays a Server Component and
+  // nothing callable crosses.
   const hasFlowAction = navActions.some((action) => action.kind === "flow");
 
   // Shared brand mark injected into both Nav and Footer chrome slots. The
@@ -388,6 +395,33 @@ export default async function LocaleLayout({
   // `(marketing)` group — a ~35-directory move for a five-page delta (spec D1).
   const isAuthRoute = isAuthPath(pathname, enabledLocales);
 
+  // Every Nav prop that is safe to serialize — shared verbatim by the
+  // server-rendered Nav (signed out) and `SignedInNav` (signed in), which adds
+  // `navItems` and `renderFlowTrigger` on its own side of the RSC boundary.
+  const navProps: SignedInNavProps = {
+    locale,
+    labels: navLabels,
+    // Deck home (#5697): the two forwards that join #5426 D4 to a real deck.
+    // `sticky` pins the bar — MarketingShell renders {nav} as a plain child of
+    // the scroll container, so under `scroll-snap-type: y mandatory` the
+    // browser snaps slide 1 to the top on load and the unpinned bar is gone
+    // before the reader touches anything. `deckMorph` is what puts BrandLogo's
+    // `.ailk-deck-brand-mark` / `.ailk-deck-brand-wordmark` hooks in the
+    // document for the D4 CSS to key off; it requires both `logo` and
+    // `wordmark` (Nav.tsx:344), which are passed below. Scoped to the SAME
+    // `isDeckHome` gate MarketingShell's snap/deckHero use, so a non-deck
+    // route's render is byte-identical to before this branch existed.
+    ...(isDeckHome ? { sticky: true, deckMorph: true } : {}),
+    siteName: SITE_NAME,
+    frame: "contained",
+    navAlignment: "right",
+    showThemeToggle: false,
+    logo: brandLogo,
+    wordmark: brandWordmark,
+    overflowLabel: navOverflowLabel,
+    actions: navActions,
+  };
+
   // Placeholder social handles (#5469 D5): `{{COMPANY_HANDLE}}` is a
   // create-ailk marker substituted at scaffold time
   // (packages/create-ailk/src/programmatic.ts), so a customer's site never
@@ -582,47 +616,14 @@ export default async function LocaleLayout({
                 ? { snap: "mandatory" as const, deckHero: true }
                 : {})}
               nav={
-                <Nav
-                  locale={locale}
-                  labels={navLabels}
-                  navItems={siteChrome.nav === "mark-only" ? [] : navItems}
-                  // Deck home (#5697): the two forwards that join #5426 D4 to a
-                  // real deck. `sticky` pins the bar — MarketingShell renders
-                  // {nav} as a plain child of the scroll container, so under
-                  // `scroll-snap-type: y mandatory` the browser snaps slide 1 to
-                  // the top on load and the unpinned bar is gone before the
-                  // reader touches anything. `deckMorph` is what puts BrandLogo's
-                  // `.ailk-deck-brand-mark` / `.ailk-deck-brand-wordmark` hooks in
-                  // the document for the D4 CSS to key off; it requires both
-                  // `logo` and `wordmark` (Nav.tsx:344), which the layout already
-                  // passes above. Scoped to the SAME `isDeckHome` gate
-                  // MarketingShell's snap/deckHero use, so a non-deck route's
-                  // render is byte-identical to before this branch existed.
-                  {...(isDeckHome ? { sticky: true, deckMorph: true } : {})}
-                  siteName={SITE_NAME}
-                  frame="contained"
-                  navAlignment="right"
-                  showThemeToggle={false}
-                  logo={brandLogo}
-                  wordmark={brandWordmark}
-                  overflowLabel={navOverflowLabel}
-                  actions={navActions}
-                  {...(hasFlowAction
-                    ? {
-                        renderFlowTrigger: (action, trigger) =>
-                          action.labelKey === "signOut" ? (
-                            <SignOutTrigger>{trigger}</SignOutTrigger>
-                          ) : (
-                            <span
-                              className="text-body-sm text-(--color-text-muted)"
-                              data-testid="nav-account-name"
-                            >
-                              {navLabels.items.account}
-                            </span>
-                          ),
-                      }
-                    : {})}
-                />
+                hasFlowAction ? (
+                  <SignedInNav {...navProps} />
+                ) : (
+                  <Nav
+                    {...navProps}
+                    navItems={siteChrome.nav === "mark-only" ? [] : navItems}
+                  />
+                )
               }
               footer={
                 <Footer