create-ailk 0.11.1 → 0.11.3

package/component-catalog.json

@@ -49,7 +49,7 @@
       "importPath": "@working-theory/templates/shells",
       "rootBarrel": "@working-theory/templates",
       "sourceRoot": "packages/templates/src/shells",
-      "count": 5
+      "count": 6
     },
     {
       "name": "docs-blog-blocks",
@@ -3015,6 +3015,17 @@
       "descriptionGrade": "weak",
       "sectionType": null
     },
+    {
+      "name": "SignedInShell",
+      "tier": "shells",
+      "sourcePath": "packages/templates/src/shells/SignedInShell.tsx",
+      "importPath": "@working-theory/templates/shells",
+      "exported": true,
+      "description": "Every AILK signed-in area runs on this frame: the admin app's workspace (AppFrame supplies its switcher, Library and gating as content) and a site's own /account area.",
+      "descriptionSource": "doc-comment",
+      "descriptionGrade": "strong",
+      "sectionType": null
+    },
     {
       "name": "DocsActionBar",
       "tier": "docs-blog-blocks",

package/component-catalog.md

@@ -15,13 +15,13 @@ The component inventory of `@working-theory/ui` and the shells of `@working-theo
 3. Check the Primitives, Panels and Shells tables too — a low-level control, a collapsible layout container, or a route-level frame lives there, not under Sections or Blocks.
 4. Only then build. If you do build, you are declaring the capability is genuinely absent.
 
-Inventory: **303 component files** across 16 tiers — 55 sections, 99 blocks, 18 chrome, 79 primitives, 6 panels, 5 shells, 5 docs-blog-blocks, 1 docs-blog-chrome, 2 docs-blog-shells, 2 scheduling-sections, 5 scheduling-blocks, 3 signal-collectors-sections, 8 signal-collectors-blocks, 2 commerce-sections, 12 commerce-blocks, 1 commerce-panels. 300 distinct names: `SchedulerEmbed`, `Separator`, `Tabs` exist in more than one tier as genuinely different components, listed once per tier with its own source path.
+Inventory: **304 component files** across 16 tiers — 55 sections, 99 blocks, 18 chrome, 79 primitives, 6 panels, 6 shells, 5 docs-blog-blocks, 1 docs-blog-chrome, 2 docs-blog-shells, 2 scheduling-sections, 5 scheduling-blocks, 3 signal-collectors-sections, 8 signal-collectors-blocks, 2 commerce-sections, 12 commerce-blocks, 1 commerce-panels. 301 distinct names: `SchedulerEmbed`, `Separator`, `Tabs` exist in more than one tier as genuinely different components, listed once per tier with its own source path.
 
-Description coverage: **299/303** components carry a capability description derived from source — 44 from the section registry's hand-authored when-to-use text, 224 from the component's own doc-comment header, 31 from its tier barrel's roster line. **4** have none; they are listed under [Undescribed components](#undescribed-components) rather than given a sentence invented from their name.
+Description coverage: **300/304** components carry a capability description derived from source — 44 from the section registry's hand-authored when-to-use text, 225 from the component's own doc-comment header, 31 from its tier barrel's roster line. **4** have none; they are listed under [Undescribed components](#undescribed-components) rather than given a sentence invented from their name.
 
-Of those, **268** are *strong* — a capability sentence you could match a requirement against — and **31** are *weak*: either one short clause, or a long one that spends itself on wiring (client boundaries, class names, which primitives it composes) instead of on what the thing is for. Weak rows are marked `(weak)` and listed in full under [Weak descriptions](#weak-descriptions). Coverage is 99%, but **findable-without-luck coverage is 88%**.
+Of those, **269** are *strong* — a capability sentence you could match a requirement against — and **31** are *weak*: either one short clause, or a long one that spends itself on wiring (client boundaries, class names, which primitives it composes) instead of on what the thing is for. Weak rows are marked `(weak)` and listed in full under [Weak descriptions](#weak-descriptions). Coverage is 99%, but **findable-without-luck coverage is 88%**.
 
-Per tier, strong out of total: **Sections** 54/55 · **Blocks** 93/99 · **Chrome** 10/18 · **Primitives** 64/79 (4 undescribed) · **Panels** 5/6 · **Shells** 4/5 · **Docs + Blog Blocks** 5/5 · **Docs + Blog Chrome** 1/1 · **Docs + Blog Shells** 0/2 · **Scheduling Sections** 2/2 · **Scheduling Blocks** 5/5 · **Signal-Collectors Sections** 3/3 · **Signal-Collectors Blocks** 7/8 · **Commerce Sections** 2/2 · **Commerce Blocks** 12/12 · **Commerce Panels** 1/1. A tier low on this line is a tier where a capability search is most likely to come up empty on something that exists.
+Per tier, strong out of total: **Sections** 54/55 · **Blocks** 93/99 · **Chrome** 10/18 · **Primitives** 64/79 (4 undescribed) · **Panels** 5/6 · **Shells** 5/6 · **Docs + Blog Blocks** 5/5 · **Docs + Blog Chrome** 1/1 · **Docs + Blog Shells** 0/2 · **Scheduling Sections** 2/2 · **Scheduling Blocks** 5/5 · **Signal-Collectors Sections** 3/3 · **Signal-Collectors Blocks** 7/8 · **Commerce Sections** 2/2 · **Commerce Blocks** 12/12 · **Commerce Panels** 1/1. A tier low on this line is a tier where a capability search is most likely to come up empty on something that exists.
 
 That grade is **mechanical**. It counts what it can measure — how much a description adds beyond the component's own name, how much of it is spent on wiring, whether the extraction came out damaged — and it cannot tell a fluent paragraph about the wrong subject from a useful one. A person reading these tables will find more rows unusable than the weak count admits. Treat it as a floor on the problem, not a measurement of it, and read the source before concluding a capability is absent.
 
@@ -365,7 +365,7 @@ Import: `import { X } from "@working-theory/ui/panels";` (or from the `@working-
 
 ---
 
-## Shells (5)
+## Shells (6)
 
 Route-level slot-frames — the outermost layout a page is placed into. They supply geometry and slots (nav / sidebar / main / footer), not content: you inject the real Nav, Footer and sidebar. A different package from every tier above: `@working-theory/templates`.
 
@@ -378,6 +378,7 @@ Import: `import { X } from "@working-theory/templates/shells";` (or from the `@w
 | `AuthShell` | The frame the five auth pages (/sign-in, /sign-up, /forgot-password, /reset-password, /verify-email) share: a brand mark top-start, one centered content column, and a slim footer. No nav — an auth page has nothing to navigate to, and the marketing Nav is exactly what this shell exists to replace on those routes. | `import { AuthShell } from "@working-theory/templates/shells"` |
 | `DeckHeroObserver` | Internal client island for MarketingShell's `deckHero` option. | internal — compose from `packages/templates/src/shells/DeckHeroObserver.tsx` |
 | `MarketingShell` | Public-facing marketing site **slot-frame**. Server Component (RSC default). A shell is a slot-defining frame: it carves out *where chrome goes* (top + bottom) and *where sections go* (the body), owning **geometry only**. Chrome (Nav/Footer) and sections **fill** the slots — nothing is baked into the component. See (first instance). *(weak)* | `import { MarketingShell } from "@working-theory/templates/shells"` |
+| `SignedInShell` | Every AILK signed-in area runs on this frame: the admin app's workspace (AppFrame supplies its switcher, Library and gating as content) and a site's own /account area. | `import { SignedInShell } from "@working-theory/templates/shells"` |
 
 ---
 

package/dist/content-payloads.js

@@ -29,8 +29,8 @@ export const CONTENT_PAYLOADS = Object.freeze([
         kind: "template-set",
         name: "scaffold-commerce",
         feature: "commerce",
-        version: "1.0.0",
-        digest: "baa4ac6e86ec7e3b367eb67e77c3407da90c7ff9ef51d5f4e1185615194543ee",
+        version: "1.0.1",
+        digest: "112704a7910dba3275defc0cb86b1b4f33fc8f262f4c09320e8f6b3a8d873916",
         sourceRoot: "packages/create-ailk/module-templates/commerce/.claude/skills/scaffold-commerce",
         files: Object.freeze([
             "references/lookup-keys-template.md",

package/dist/module-architecture.js

@@ -790,6 +790,15 @@ export const MODULE_SLICES = {
             // deliverable by BOTH bundles.
             "apps/api/src/services/inbox-messages.ts",
             "apps/api/src/routes/workspaces/messages.ts",
+            // #7399 — the two siblings #6216 left `workspace`-only. They register
+            // under that same `workspace || multi-tenant` gate, so a scaffold with
+            // `multi-tenant` and without `workspace` loaded them with no file behind
+            // the specifier and 500'd every request at server construction. Co-owned
+            // with `workspace` (see that slice's entry below); both import only
+            // `lib/tenant-db.ts` (owned here) and base files.
+            // `__tests__/tenancy-slice-resolution.test.ts` holds the whole gate set.
+            "apps/api/src/routes/workspaces/general.ts",
+            "apps/api/src/routes/workspaces/members.ts",
             "apps/api/src/lib/tenant-db.ts",
             "apps/api/src/lib/ws-token.ts",
             // #6157 D16 — the magnet Admin authoring surface, co-owned with
@@ -890,6 +899,8 @@ export const MODULE_SLICES = {
             "apps/web/app/[locale]/(authed)/admin/page.tsx",
             "apps/web/app/[locale]/(authed)/admin/site/page.tsx",
             "apps/web/app/[locale]/(authed)/admin/team/page.tsx",
+            // Co-owned with `multi-tenant` (#7399) — see that slice's entry: both
+            // register under the workspace||multi-tenant gate.
             "apps/api/src/routes/workspaces/general.ts",
             "apps/api/src/routes/workspaces/members.ts",
             // Co-owned with `multi-tenant` (#6216) — see that slice's entry: the

package/dist/surfaces.d.ts

@@ -162,11 +162,10 @@ export declare function surfaceForRouteDir(routeDir: string): string | undefined
  * file only when the target does not already have it — it never overwrites,
  * the same rule routes themselves follow.
  *
- * `(authed)/account` depending on two files INSIDE `(authed)/waitlist`
- * (`ForbiddenState.tsx`, `format.ts`) is real, found by reading the account
- * page's own imports, not guessed from the issue text: the account page
- * renders a shared "forbidden" empty state and shared count/date formatters
- * that the waitlist dashboard also uses, rather than duplicating them.
+ * Every list is read from the route's own imports, not guessed from issue
+ * text. `(authed)/account` no longer reaches into `(authed)/waitlist` (#7430):
+ * its layout renders the site's mark through `siteLogo()` on SignedInShell,
+ * so `site-logo.tsx` and the `site-brand.tsx` it reads travel with it.
  */
 export declare const ROUTE_DEPENDENCIES: Readonly<Record<string, readonly string[]>>;
 /**

package/dist/surfaces.js

@@ -609,6 +609,13 @@ export const ROUTE_SINCE = {
     // choice #5048's "projects/apply" entry already made for the same reason.
     "(authed)": "0.18.0",
     "(authed)/account": "0.18.0",
+    // #7430 — the base account area's three new route directories (spec 7423
+    // U4): item detail, User settings and Support. Genuinely new, so they
+    // attach at today's fixed-group version, the same rule #5977, #5678, #5479,
+    // #5371 and #5048 applied.
+    "(authed)/account/inbox/[kind]/[id]": "0.30.0",
+    "(authed)/account/settings": "0.30.0",
+    "(authed)/account/support": "0.30.0",
     // The leads inbox (#5678). The ROUTE ships in every scaffold, Free
     // included — lead capture is a never-gate surface, so reading a lead back
     // is one too. Whether it shows a ROW is a separate question with two
@@ -691,11 +698,10 @@ export function surfaceForRouteDir(routeDir) {
  * file only when the target does not already have it — it never overwrites,
  * the same rule routes themselves follow.
  *
- * `(authed)/account` depending on two files INSIDE `(authed)/waitlist`
- * (`ForbiddenState.tsx`, `format.ts`) is real, found by reading the account
- * page's own imports, not guessed from the issue text: the account page
- * renders a shared "forbidden" empty state and shared count/date formatters
- * that the waitlist dashboard also uses, rather than duplicating them.
+ * Every list is read from the route's own imports, not guessed from issue
+ * text. `(authed)/account` no longer reaches into `(authed)/waitlist` (#7430):
+ * its layout renders the site's mark through `siteLogo()` on SignedInShell,
+ * so `site-logo.tsx` and the `site-brand.tsx` it reads travel with it.
  */
 export const ROUTE_DEPENDENCIES = {
     // #5963 — the (auth) group's layout renders the brand mark through
@@ -715,12 +721,45 @@ export const ROUTE_DEPENDENCIES = {
     "(auth)/sign-up": ["apps/web/lib/auth-env.ts"],
     "(auth)/forgot-password": ["apps/web/lib/auth-env.ts"],
     "(auth)/reset-password": ["apps/web/lib/auth-env.ts"],
-    "(authed)": ["apps/web/auth.ts", "apps/web/lib/auth-env.ts"],
+    // #7430 — the group's layout reads `isAccountPath()` to give the account
+    // area its member-facing signed-out gate.
+    "(authed)": [
+        "apps/web/auth.ts",
+        "apps/web/lib/auth-env.ts",
+        "apps/web/lib/auth-routes.ts",
+    ],
     "(authed)/account": [
         "apps/web/lib/account-config.ts",
         "apps/web/lib/server-api.ts",
-        `${ROUTE_ROOT}/(authed)/waitlist/components/ForbiddenState.tsx`,
-        `${ROUTE_ROOT}/(authed)/waitlist/format.ts`,
+        "apps/web/lib/site-brand.tsx",
+        "apps/web/lib/site-logo.tsx",
+    ],
+    // #7430 — the three child routes also import files in their PARENT's
+    // directory. A scaffold whose `(authed)/account` predates #7430 keeps its
+    // own copy of that route (sync-routes never overwrites), so the files the
+    // children need travel with them: each is new in #7430, never a changed
+    // file sync-routes could not update.
+    "(authed)/account/inbox/[kind]/[id]": [
+        "apps/web/lib/account-config.ts",
+        "apps/web/lib/server-api.ts",
+        `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
+        `${ROUTE_ROOT}/(authed)/account/error-row.tsx`,
+        `${ROUTE_ROOT}/(authed)/account/retry-button.tsx`,
+    ],
+    "(authed)/account/settings": [
+        "apps/web/lib/account-config.ts",
+        "apps/web/lib/auth-env.ts",
+        "apps/web/lib/server-api.ts",
+        "apps/web/lib/site-brand.tsx",
+        "apps/web/lib/site-theme.ts",
+        `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
+        `${ROUTE_ROOT}/(authed)/account/support-actions.ts`,
+    ],
+    "(authed)/account/support": [
+        "apps/web/lib/account-config.ts",
+        "apps/web/lib/server-api.ts",
+        `${ROUTE_ROOT}/(authed)/account/account-data.ts`,
+        `${ROUTE_ROOT}/(authed)/account/support-actions.ts`,
     ],
     "(authed)/admin": [
         "apps/web/lib/server-api.ts",
@@ -773,6 +812,9 @@ export const ROUTE_MESSAGE_NAMESPACES = {
     "(auth)/reset-password": ["auth"],
     "(auth)/verify-email": ["auth"],
     "(authed)/account": ["account"],
+    "(authed)/account/inbox/[kind]/[id]": ["account"],
+    "(authed)/account/settings": ["account"],
+    "(authed)/account/support": ["account"],
     "(authed)/admin": ["admin"],
     "(authed)/leads": ["leadsInbox"],
     // #5977 — every string on both editor routes comes from the `edit`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ailk",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "description": "Scaffolder for AI Launch Kit — `pnpm create ailk@latest <dir>` produces a starter repo consuming @working-theory/* from npm (per ADR 0007).",
   "type": "module",
   "main": "./dist/index.js",
@@ -27,8 +27,8 @@
     "tar": "^7.5.21"
   },
   "devDependencies": {
-    "@working-theory/schema": "0.30.0",
-    "@working-theory/templates": "0.30.0"
+    "@working-theory/schema": "0.31.0",
+    "@working-theory/templates": "0.31.0"
   },
   "repository": {
     "type": "git",

package/templates/.env.example

@@ -59,10 +59,20 @@ CONTENT_ADAPTER=mdx
 # Unset in production, either one makes the API log a startup warning; the
 # API keeps running.
 # FRONTEND_URL is the site the browser loads (no trailing slash). Set it on the
-# API project: unset in production, CORS, cookie origin checks and the
-# billing-portal return URLs fall back to http://localhost:3000, and checkout
-# answers 500 to a caller without X-Internal-Auth.
+# API project: it is the first trusted origin for CORS, cookie-authenticated
+# writes and checkout redirects. Unset in production, those three trust only
+# AILK_TRUSTED_ORIGINS below (with neither set, they refuse every browser
+# origin and checkout answers 500 to a caller without X-Internal-Auth), and the
+# billing-portal return URLs fall back to http://localhost:3000.
 # FRONTEND_URL=https://your-domain.com
+# AILK_TRUSTED_ORIGINS lists MORE browser origins the API trusts, beside
+# FRONTEND_URL — the Admin app and spoke sites a hub API serves. Comma-separated
+# exact origins, written as a browser sends them: scheme + host (+ port), no
+# path, no trailing slash, lower-case. `*`, wildcard hosts and any other form
+# are refused and the API does not start; production requires https. Each
+# listed origin gets CORS reads, cookie writes and checkout-redirect trust, so
+# list ONLY origins the deployment owner operates — never another party's site.
+# AILK_TRUSTED_ORIGINS=https://admin.your-domain.com,https://spoke.example
 # OSS_API_INTERNAL_SECRET gates POST /v1/checkout/sessions. Unset, the route
 # admits every caller. Set, it answers 401 to any caller that does not send it
 # as X-Internal-Auth — including the MCP start_purchase tool and a browser
@@ -439,6 +449,35 @@ CONTENT_ADAPTER=mdx
 # API is not on localhost.
 # AILK_API_URL=http://localhost:3001
 #
+# Hub and spokes — per-visitor lead limits (#7394). When one apps/api (the
+# hub) is the lead sink for several apps/web sites (spokes) that call it
+# server-to-server through AILK_API_URL, every visitor of a spoke arrives at
+# the hub from the spoke's one egress IP. A spoke holding a hub-issued key
+# forwards the visitor's IP on its three lead writes (contact, newsletter,
+# callback), and the hub counts each visitor separately. Runbook:
+# docs/runbooks/site-configuration.md § Hub and spokes: per-visitor lead
+# limits. All four unset = the behaviour before #7394.
+#
+# HUB (apps/api). One key per spoke, comma-separated; each at least 32
+# characters (mint with `openssl rand -hex 32`). A shorter entry is ignored
+# with a warning naming its position. A key's position identifies its spoke
+# in the rate-limit log: to revoke one, BLANK its entry (`k1,,k3`) rather
+# than deleting it, so no other key changes position.
+# AILK_VISITOR_FORWARD_KEYS=
+#
+# HUB (apps/api). The leads scope's per-visitor limit per minute, and each
+# key's own ceiling per minute across all of its visitors. Whole numbers from
+# 1 to 999999; an invalid value is ignored with a warning. Defaults: 10 and
+# 300.
+# AILK_RATE_LIMIT_LEADS_PER_MINUTE=10
+# AILK_RATE_LIMIT_LEADS_PER_KEY_PER_MINUTE=300
+#
+# SPOKE (apps/web, server-only — never NEXT_PUBLIC_). This spoke's key: one
+# entry of the hub's AILK_VISITOR_FORWARD_KEYS. Sent only when AILK_API_URL
+# is https (or loopback). Issue a key only to a spoke whose platform
+# overwrites x-forwarded-for / x-real-ip with the real client address.
+# AILK_VISITOR_FORWARD_KEY=
+#
 # NEXT_PUBLIC_ENABLED_LOCALES — do NOT set by hand. Baked at build time by
 # apps/web/next.config.mjs from project.yaml `product.locales` (falls back to
 # "en" when project.yaml is absent) and read by middleware.ts, the sitemap

package/templates/apps/api/.env.example

@@ -15,6 +15,11 @@ PORT=3002
 # Frontend URL (for CORS)
 # =============================================================================
 FRONTEND_URL=http://localhost:3000
+# More trusted browser origins (Admin app, spoke sites): comma-separated exact
+# origins, no path or trailing slash; `*` is refused at startup; https in production.
+# Each listed origin gets credentialed CORS, cookie writes and checkout-redirect
+# trust — list only origins the deployment owner operates.
+# AILK_TRUSTED_ORIGINS=https://admin.your-domain.com,https://spoke.example
 
 # =============================================================================
 # Local Database (required in production)

package/templates/apps/api/src/__tests__/cors.test.ts

@@ -44,7 +44,7 @@ const DRAFT_PATCH_URL = "/v1/project-listings/drafts/listing_abc123";
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
 type App = any;
 
-const ENV_KEYS = ["FRONTEND_URL", "NODE_ENV"] as const;
+const ENV_KEYS = ["FRONTEND_URL", "AILK_TRUSTED_ORIGINS", "NODE_ENV"] as const;
 
 /**
  * Build a server whose `config` was resolved from `env`. Restores the prior
@@ -52,6 +52,7 @@ const ENV_KEYS = ["FRONTEND_URL", "NODE_ENV"] as const;
  */
 async function buildWith(env: {
   FRONTEND_URL?: string;
+  AILK_TRUSTED_ORIGINS?: string;
   NODE_ENV: string;
 }): Promise<App> {
   for (const key of ENV_KEYS) {
@@ -147,18 +148,19 @@ describe("CORS preflight (#5397)", () => {
     // ACT
     const response = await preflight(app, FOREIGN_ORIGIN, "PATCH");
 
-    // ASSERT — with a STRING `origin` option, @fastify/cors echoes the
-    // configured origin rather than the requester's
-    // (`getAccessControlAllowOriginHeader`), and the refusal is the browser's:
-    // it blocks any response whose allow-origin is not its own origin. So the
-    // contract to pin is that the foreign origin is never named back, and the
-    // wildcard never appears — `credentials: true` with `*` would let any site
-    // read credentialed responses (the security-review M1 posture server.ts
-    // already documents). Widening `methods` must not widen WHO may use them.
+    // ASSERT — the refusal is the browser's: it blocks any response whose
+    // allow-origin is not its own origin. So the contract to pin is that the
+    // foreign origin is never named back, and the wildcard never appears —
+    // `credentials: true` with `*` would let any site read credentialed
+    // responses (the security-review M1 posture server.ts already documents).
+    // Widening `methods` must not widen WHO may use them. With the ARRAY
+    // `origin` option (#7395 D4), @fastify/cors writes no allow-origin header
+    // at all for an unlisted origin (D6.4); before #7395 it echoed the one
+    // configured string.
     const allowOrigin = response.headers["access-control-allow-origin"];
     expect(allowOrigin).not.toBe(FOREIGN_ORIGIN);
     expect(allowOrigin).not.toBe("*");
-    expect(allowOrigin).toBe(FRONTEND_URL);
+    expect(allowOrigin).toBeUndefined();
   });
 
   it("advertises every method the registered route table actually serves", async () => {
@@ -193,3 +195,82 @@ describe("CORS preflight (#5397)", () => {
     }
   });
 });
+
+// ── #7395 — the trusted-origin allowlist (AC-4) ──────────────────────────────
+//
+// One deployment serves the hub site, its Admin app and every spoke, so CORS
+// answers for each origin the operator listed in FRONTEND_URL or
+// AILK_TRUSTED_ORIGINS, and for no other — in development as in production,
+// since the reflect-any dev arm is gone (D4). A credentialed GET, not only a
+// preflight, carries the header, so a hand-written OPTIONS route cannot pass.
+
+describe("CORS trusted-origin allowlist (#7395)", () => {
+  const HUB = "https://hub.example";
+  const SPOKE_A = "https://spoke-a.example";
+  const priorEnv = new Map<string, string | undefined>(
+    ENV_KEYS.map((key) => [key, process.env[key]]),
+  );
+  let app: App;
+
+  afterEach(async () => {
+    if (app) {
+      await app.close();
+      app = undefined;
+    }
+    for (const [key, value] of priorEnv) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+    jest.resetModules();
+  });
+
+  describe.each(["production", "development"])("NODE_ENV=%s", (nodeEnv) => {
+    beforeEach(async () => {
+      app = await buildWith({
+        FRONTEND_URL: HUB,
+        AILK_TRUSTED_ORIGINS: SPOKE_A,
+        NODE_ENV: nodeEnv,
+      });
+    });
+
+    it("allows a PATCH preflight from a listed spoke, with credentials and Vary: Origin", async () => {
+      const response = await preflight(app, SPOKE_A, "PATCH");
+
+      expect(response.headers["access-control-allow-origin"]).toBe(SPOKE_A);
+      expect(response.headers["access-control-allow-credentials"]).toBe(
+        "true",
+      );
+      expect(String(response.headers["vary"] ?? "")).toMatch(/\bOrigin\b/i);
+      expect(allowedMethods(response)).toContain("PATCH");
+    });
+
+    it("names a listed spoke on a credentialed GET, not only on a preflight", async () => {
+      const response = await app.inject({
+        method: "GET",
+        url: "/health",
+        headers: { origin: SPOKE_A, cookie: "better-auth.session_token=x" },
+      });
+
+      expect(response.statusCode).toBe(200);
+      expect(response.headers["access-control-allow-origin"]).toBe(SPOKE_A);
+      expect(response.headers["access-control-allow-credentials"]).toBe(
+        "true",
+      );
+    });
+
+    it("still allows the primary FRONTEND_URL origin", async () => {
+      const response = await preflight(app, HUB, "PATCH");
+
+      expect(response.headers["access-control-allow-origin"]).toBe(HUB);
+    });
+
+    it("writes no allow-origin header for an unlisted origin", async () => {
+      const response = await preflight(app, FOREIGN_ORIGIN, "PATCH");
+
+      expect(response.headers["access-control-allow-origin"]).toBeUndefined();
+    });
+  });
+});

package/templates/apps/api/src/__tests__/leads-forwarded-rate-limit.test.ts

@@ -0,0 +1,135 @@
+/**
+ * @file leads-forwarded-rate-limit.test.ts
+ * @description #7394 AC-7 — a keyed spoke's lead writes are limited per
+ * visitor end to end, through the real `build()` and the REAL
+ * `@fastify/rate-limit` global ceiling.
+ *
+ * `server.test.ts` (and ten other `apps/api` files) replace
+ * `@fastify/rate-limit` with a no-op for the whole file, so none of them can
+ * observe the global ceiling. This file does not mock it. It mocks only the
+ * two boundaries `server.test.ts` mocks for infrastructure reasons:
+ * `@fastify/cors` and `@working-theory/email` (an ESM-only transitive dep).
+ *
+ * `DATABASE_URL` is unset for the file's duration, so a lead write takes the
+ * zero-config path, where the route refuses the empty body `{}` with a 400
+ * before any write. With the setup file's placeholder `DATABASE_URL`, the
+ * route would first try to resolve the site's workspace against a database
+ * this test does not have. The limiter runs on `onRequest`, before either.
+ *
+ * Every request comes from one `x-forwarded-for` — the spoke host. Each
+ * sub-case gets a fresh `build()` after `__resetBuckets()`, so neither the
+ * in-house buckets nor the plugin's own in-memory store carry over.
+ *
+ * Spec: docs/specs/7394-the-leads-rate-limit-scope-spec.md §5.1 AC-7.
+ */
+
+import { __resetBuckets } from "../middleware/rate-limit";
+import { build } from "../server";
+
+jest.mock("@fastify/cors", () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
+}));
+
+const KEY = "0123456789abcdef".repeat(4); // gitleaks:allow — test fixture, not a credential (#7394)
+const SPOKE_HOST = "198.51.100.7";
+
+/** A distinct, valid visitor IP per index. */
+function visitor(i: number): string {
+  return `203.0.${Math.floor(i / 250)}.${(i % 250) + 1}`;
+}
+
+function headersFor(
+  visitorIp: string,
+  withKey: boolean,
+): Record<string, string> {
+  return {
+    "x-forwarded-for": SPOKE_HOST,
+    "x-ailk-visitor-ip": visitorIp,
+    ...(withKey && { "x-ailk-visitor-forward-key": KEY }),
+  };
+}
+
+describe("leads rate limit for a keyed spoke, against the real global ceiling (#7394 AC-7)", () => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any matches server.test.ts
+  let app: any;
+  const prior = process.env.AILK_VISITOR_FORWARD_KEYS;
+  const priorDatabaseUrl = process.env.DATABASE_URL;
+
+  async function statuses(
+    count: number,
+    request: (i: number) => {
+      method: string;
+      url: string;
+      headers: Record<string, string>;
+      payload?: unknown;
+    },
+  ): Promise<number[]> {
+    const codes: number[] = [];
+    for (let i = 0; i < count; i++) {
+      const res = await app.inject(request(i));
+      codes.push(res.statusCode);
+    }
+    return codes;
+  }
+
+  function leadWrite(visitorIp: string, withKey: boolean) {
+    return {
+      method: "POST",
+      url: "/v1/leads/submit",
+      headers: headersFor(visitorIp, withKey),
+      payload: {},
+    };
+  }
+
+  beforeEach(async () => {
+    __resetBuckets();
+    process.env.AILK_VISITOR_FORWARD_KEYS = KEY;
+    delete process.env.DATABASE_URL;
+    app = await build();
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    if (app) await app.close();
+    app = undefined;
+  });
+
+  afterAll(() => {
+    if (prior === undefined) delete process.env.AILK_VISITOR_FORWARD_KEYS;
+    else process.env.AILK_VISITOR_FORWARD_KEYS = prior;
+    if (priorDatabaseUrl !== undefined)
+      process.env.DATABASE_URL = priorDatabaseUrl;
+  });
+
+  it("(a) 61 keyed lead writes from distinct visitors behind one spoke host: none is 429", async () => {
+    const codes = await statuses(61, (i) => leadWrite(visitor(i), true));
+    // The route refuses `{}` before any write, so every answer is that 400.
+    expect(codes.every((code) => code === 400)).toBe(true);
+  });
+
+  it("(b) 11 keyed lead writes from one visitor: the eleventh is 429", async () => {
+    const codes = await statuses(11, () => leadWrite("203.0.113.1", true));
+    expect(codes.slice(0, 10).every((code) => code === 400)).toBe(true);
+    expect(codes[10]).toBe(429);
+  });
+
+  it("(c) 11 unkeyed lead writes from distinct visitors: the eleventh is 429", async () => {
+    const codes = await statuses(11, (i) => leadWrite(visitor(i), false));
+    expect(codes.slice(0, 10).every((code) => code === 400)).toBe(true);
+    expect(codes[10]).toBe(429);
+  });
+
+  it("(d) 61 keyed GET /health from distinct visitors: the global ceiling still keys on the spoke host", async () => {
+    const codes = await statuses(61, (i) => ({
+      method: "GET",
+      url: "/health",
+      headers: headersFor(visitor(i), true),
+    }));
+    expect(codes[59]).toBe(200);
+    expect(codes[60]).toBe(429);
+  });
+});

package/templates/apps/api/src/__tests__/server.test.ts

@@ -474,7 +474,8 @@ describe("#6216 D11 — a lead_… path segment is truncated to 8 characters, cs
 //
 // POST /v1/checkout/sessions admits a caller without X-Internal-Auth when
 // OSS_API_INTERNAL_SECRET is unset, and with FRONTEND_URL unset its redirect
-// lock answers 500 while the CORS/cookie origin checks pin to localhost. Both
+// lock answers 500 while CORS and cookie writes trust only AILK_TRUSTED_ORIGINS
+// (#7395 D5; before #7395 they pinned to localhost). Both
 // are optional by design (OSS standalone compat), so startup must never fail
 // on them — but a production boot says so, once per variable. Each case rebuilds the module graph because `config/index.ts`
 // snapshots NODE_ENV at import time.
@@ -545,6 +546,9 @@ describe("#6889 — production startup warns on an unset FRONTEND_URL or OSS_API
     });
     expect(naming(messages, "FRONTEND_URL")).toHaveLength(1);
     expect(naming(messages, "OSS_API_INTERNAL_SECRET")).toHaveLength(0);
+    // #7395 D5 — nothing is pinned to localhost any more; an unset
+    // FRONTEND_URL in production trusts only AILK_TRUSTED_ORIGINS.
+    expect(naming(messages, "FRONTEND_URL")[0]).not.toContain("localhost:3000");
   });
 
   it("warns exactly once naming OSS_API_INTERNAL_SECRET when it is unset in production", async () => {