create-ailk 0.11.2 → 0.11.4

package/templates/apps/web/app/[locale]/(authed)/account/support-actions.ts

@@ -0,0 +1,98 @@
+"use server";
+
+/**
+ * account/support-actions.ts — the account area's Support request action.
+ *
+ * `submitSupportRequest` (#7430, spec 7423 D11) — files a Support request
+ * (and, from User settings › Privacy, an account-deletion request) as a
+ * contact lead: `POST /v1/leads/submit` with `source: "web"`, the session's
+ * email and the payload `{ kind, subject, message }`. No `siteId` — the
+ * route resolves the tenant server-side and ignores a posted one (#6203).
+ * The request lands in the admin Inbox as a message. Not a `*Action`-suffixed
+ * export in a `*.actions.ts` file: lead capture already has its MCP twin
+ * (`captureLeadAction` ↔ `ailkCaptureLead`), so this is not a second
+ * Server-Action/MCP-tool pair (apps/mcp's parity test).
+ *
+ * Its own module, apart from `actions.ts`, so `create-ailk sync-routes` can
+ * bring it along with the Support and User settings routes as a new file: a
+ * scaffold's existing `actions.ts` is never overwritten.
+ */
+
+import { leads, visitorForwardHeaders } from "@working-theory/api-client";
+import { headers } from "next/headers";
+
+import { auth } from "../../../../auth";
+
+/** PII-safe error identity for logs (the `checkout.actions.ts` idiom: `err.name` only). */
+function errorName(err: unknown): string {
+  return err instanceof Error ? err.name : "unknown";
+}
+
+/** What the request forms render after a submit. */
+export type SupportRequestState =
+  | { kind: "idle" }
+  | { kind: "success" }
+  | { kind: "error"; reason: "required" | "failed" | "unavailable" };
+
+const MAX_SUBJECT = 200;
+const MAX_MESSAGE = 5000;
+
+function field(formData: FormData, name: string): string {
+  const value = formData.get(name);
+  return typeof value === "string" ? value.trim() : "";
+}
+
+/** A 503 whose body names `lead_capture_not_configured` (contact.actions.ts's reading). */
+function isNotConfigured(res: { status: number; body: unknown }): boolean {
+  return (
+    res.status === 503 &&
+    typeof res.body === "object" &&
+    res.body !== null &&
+    (res.body as { error?: unknown }).error === "lead_capture_not_configured"
+  );
+}
+
+/**
+ * Files the signed-in member's Support (or deletion) request. The email is
+ * the session's own — never a form field — so a request always names the
+ * person who sent it.
+ */
+export async function submitSupportRequest(
+  _prev: SupportRequestState,
+  formData: FormData,
+): Promise<SupportRequestState> {
+  const kind = field(formData, "kind") === "deletion" ? "deletion" : "support";
+  const subject = field(formData, "subject");
+  const message = field(formData, "message");
+  if (!subject || !message || subject.length > MAX_SUBJECT || message.length > MAX_MESSAGE) {
+    return { kind: "error", reason: "required" };
+  }
+
+  try {
+    const requestHeaders = await headers();
+    const session = await auth.api.getSession({ headers: requestHeaders });
+    if (!session) return { kind: "error", reason: "failed" };
+
+    const body = {
+      source: "web",
+      email: session.user.email,
+      payload: { kind, subject, message },
+    };
+    // #7394 — a spoke counts the request against the visitor's own budget.
+    const forwarded = visitorForwardHeaders(
+      requestHeaders,
+      process.env.AILK_VISITOR_FORWARD_KEY,
+    );
+    const res = forwarded
+      ? await leads.submit(body, { headers: forwarded })
+      : await leads.submit(body);
+    if (!res.ok) {
+      console.error(`[submitSupportRequest] status=${res.status}`);
+      return { kind: "error", reason: isNotConfigured(res) ? "unavailable" : "failed" };
+    }
+    return { kind: "success" };
+  } catch (err) {
+    console.error(`[submitSupportRequest] errName=${errorName(err)}`);
+    return { kind: "error", reason: "failed" };
+  }
+}

package/templates/apps/web/app/[locale]/(authed)/layout.tsx

@@ -10,17 +10,46 @@
  * surface — #4984). This guard reads no public-route auth-requirement flag
  * (spec Clarifications) — that flag governs whether PUBLIC marketing routes
  * redirect; tenant signup data is never public, so this gate always applies.
+ *
+ * The gate's providers are resolved HERE, on the server, and passed down as a
+ * prop (#7419): `SignInGate` is a client component, and the provider env
+ * `getActiveProviderIds()` reads is server-only — read in the browser it is
+ * always empty, which made every gated page claim sign-in was not configured.
+ *
+ * When the email sign-in link is on (#7435 § D9 — the same
+ * `getActiveProviderIds()` predicate `auth.ts` registers the plugin on), the
+ * layout resolves `/sign-in`'s card copy here too and passes it as the gate's
+ * `emailLink` prop; otherwise it passes nothing and the gate renders as before.
+ *
+ * On an account path (#7430, `isAccountPath` on the forwarded `x-pathname`)
+ * the visitor is a member, not an operator: the gate reads the member-facing
+ * `account.gate` copy instead of `waitlistDashboard.gate` (which asks for
+ * provider env vars "to enable operator access"). When no sign-in method is
+ * on, the layout renders that member gate itself so its headline is a real
+ * `<h1>` — `SignInGate`'s not-configured branch renders `EmptyState`, whose
+ * headline is a `<p>` — and its one action leads back to the site rather than
+ * to a sign-in page that has nothing to offer. An absent `x-pathname` keeps
+ * the operator copy, the same fail-safe direction as the locale layout's
+ * account branch.
  */
 
 import { localeHref } from "@working-theory/ui";
+import { Button, Heading, Link, Text } from "@working-theory/ui/primitives";
+import type { AuthPanelProvider } from "@working-theory/ui/sections";
+import { readLocales } from "@working-theory/web-i18n";
 import { headers } from "next/headers";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement, ReactNode } from "react";
 
+import { resolveSignInCardText } from "../(auth)/sign-in/sign-in-text";
 import { auth } from "../../../auth";
+import { getActiveProviderIds } from "../../../lib/auth-env";
+import { isAccountPath } from "../../../lib/auth-routes";
 
 import { SignInGate } from "./sign-in-gate";
 
+const SUPPORTED_PROVIDERS: readonly AuthPanelProvider[] = ["google", "github"];
+
 interface Props {
   children: ReactNode;
   params: Promise<{ locale: string }>;
@@ -31,13 +60,56 @@ export default async function AuthedLayout({
   params,
 }: Props): Promise<ReactElement> {
   const { locale } = await params;
-  const session = await auth.api.getSession({ headers: await headers() });
+  const requestHeaders = await headers();
+  const session = await auth.api.getSession({ headers: requestHeaders });
 
   if (!session) {
+    // No `x-pathname`, no locale read: a render outside the middleware keeps
+    // the operator gate without touching the locale config.
+    const pathname = requestHeaders.get("x-pathname");
+    const isAccount =
+      pathname !== null && isAccountPath(pathname, readLocales());
     const t = await getTranslations({
       locale,
-      namespace: "waitlistDashboard.gate",
+      namespace: isAccount ? "account.gate" : "waitlistDashboard.gate",
     });
+    const active = getActiveProviderIds();
+    const emailLink = active.includes("magic-link")
+      ? { text: await resolveSignInCardText(locale) }
+      : undefined;
+    const providers = active.filter((id): id is AuthPanelProvider =>
+      (SUPPORTED_PROVIDERS as readonly string[]).includes(id),
+    );
+    const signInPath = localeHref(locale, "/sign-in");
+
+    if (isAccount && providers.length === 0 && !emailLink) {
+      return (
+        <div
+          className="flex min-h-screen flex-col items-center justify-center gap-4 py-section text-center"
+          data-testid="account-sign-in-gate"
+        >
+          <Heading level={1} visual={4}>
+            {t("emptyHeadline")}
+          </Heading>
+          <Text variant="body-sm" tone="muted" className="max-w-xs">
+            {t("emptyDescription")}
+          </Text>
+          {/* With no sign-in method on, /sign-in has nothing for a member
+              either, so the one action goes back to the site. Outline
+              action, 44px on a phone and 36px from md up. */}
+          <Button asChild variant="secondary" className="max-md:min-h-11">
+            <Link
+              href={localeHref(locale, "/")}
+              variant="bare"
+              data-testid="account-sign-in-gate-home"
+            >
+              {t("homeLink")}
+            </Link>
+          </Button>
+        </div>
+      );
+    }
+
     return (
       <SignInGate
         labels={{
@@ -45,7 +117,9 @@ export default async function AuthedLayout({
           emptyDescription: t("emptyDescription"),
           signInLinkLabel: t("signInLink"),
         }}
-        signInPath={localeHref(locale, "/sign-in")}
+        signInPath={signInPath}
+        providers={providers}
+        {...(emailLink ? { emailLink } : {})}
       />
     );
   }

package/templates/apps/web/app/[locale]/(authed)/sign-in-gate.tsx

@@ -9,11 +9,22 @@
  * (#4984) carrying `?next=<pathname>`, so a visitor who prefers the full
  * sign-in surface lands back on the exact page they requested.
  *
+ * `providers` arrives as a prop, resolved by the `(authed)` layout (an RSC)
+ * from the server's provider env (#7419). This module must never read that
+ * env itself: it is bundled for the browser, where `GOOGLE_CLIENT_ID` and the
+ * like are always unset, so a client-side read always came back empty.
+ *
  * Zero active providers → an `EmptyState` naming the missing configuration
  * (the `AuthPanel` UI-contract forbids fabricating a session — spec
  * Clarifications), still followed by the sign-in link. `callbackURL` is the
  * current pathname (via `usePathname()`) so a successful social sign-in
  * lands back on the exact dashboard page the visitor requested.
+ *
+ * Email sign-in link (#7435 § D9): when the layout passes `emailLink`, the
+ * gate renders `/sign-in`'s own `SignInCard` — the same providers plus "Email
+ * me a sign-in link" — in place of `AuthPanel`, whose email + password form
+ * has no submit wiring and would otherwise sit inert beside the new field.
+ * Without the prop every render is what it was before.
  */
 
 import { EmptyState, Link } from "@working-theory/ui/primitives";
@@ -22,12 +33,11 @@ import { createAuthClient } from "better-auth/react";
 import { usePathname } from "next/navigation";
 import type { ReactElement } from "react";
 
-import { getActiveProviderIds } from "../../../lib/auth-env";
+import { SignInCard } from "../(auth)/sign-in/sign-in-card";
+import type { SignInCardText } from "../(auth)/sign-in/sign-in-text";
 
 const authClient = createAuthClient();
 
-const SUPPORTED_PROVIDERS: readonly AuthPanelProvider[] = ["google", "github"];
-
 export interface SignInGateLabels {
   emptyHeadline: string;
   emptyDescription: string;
@@ -39,18 +49,27 @@ export interface SignInGateProps {
   labels: SignInGateLabels;
   /** Locale-prefixed sign-in page path — `localeHref(locale, "/sign-in")`. */
   signInPath: string;
+  /** The active social providers, resolved server-side by the layout (#7419). */
+  providers: AuthPanelProvider[];
+  /**
+   * Present iff the email sign-in link is on (#7435) — the sign-in card's
+   * copy, resolved server-side by the layout.
+   */
+  emailLink?: { text: SignInCardText };
 }
 
-export function SignInGate({ labels, signInPath }: SignInGateProps): ReactElement {
+export function SignInGate({
+  labels,
+  signInPath,
+  providers,
+  emailLink,
+}: SignInGateProps): ReactElement {
   const pathname = usePathname();
-  const providers = getActiveProviderIds().filter(
-    (id): id is AuthPanelProvider =>
-      (SUPPORTED_PROVIDERS as readonly string[]).includes(id),
-  );
+  const signInHref = `${signInPath}?next=${encodeURIComponent(pathname)}`;
 
   const signInLink = (
     <Link
-      href={`${signInPath}?next=${encodeURIComponent(pathname)}`}
+      href={signInHref}
       data-testid="sign-in-gate-link"
       // 24px hit-area floor (Rule 14) — a bare inline link's line-height box
       // falls short on its own.
@@ -60,6 +79,30 @@ export function SignInGate({ labels, signInPath }: SignInGateProps): ReactElemen
     </Link>
   );
 
+  if (emailLink) {
+    const { text } = emailLink;
+    return (
+      <div
+        className="flex min-h-screen flex-col items-center justify-center gap-4 py-section"
+        data-testid="sign-in-gate"
+      >
+        <SignInCard
+          providers={providers}
+          method="sso"
+          next={pathname}
+          labels={text.labels}
+          notConfiguredSubhead={text.notConfiguredSubhead}
+          errorLabels={text.errorLabels}
+          emailLink
+          errorCallbackURL={signInHref}
+          signInHref={signInHref}
+          emailLinkLabels={text.emailLinkLabels}
+        />
+        {signInLink}
+      </div>
+    );
+  }
+
   if (providers.length === 0) {
     return (
       <div

package/templates/apps/web/app/[locale]/contact/__tests__/contact.actions.test.ts

@@ -12,18 +12,31 @@
 
 import { captureLeadAction } from "../contact.actions.js";
 
-// Mock @working-theory/api-client
+// Mock @working-theory/api-client. `visitorForwardHeaders` stays real (#7394)
+// so AC-9 compares the action's `init` with the helper's own output.
 jest.mock("@working-theory/api-client", () => ({
   leads: {
     submit: jest.fn(),
   },
+  visitorForwardHeaders: jest.requireActual("@working-theory/api-client")
+    .visitorForwardHeaders,
 }));
 
-import { leads } from "@working-theory/api-client";
+// next/headers' `headers()` is request-scoped in Next; outside it, it is
+// mocked here the way flow.actions.test.ts does (#7394 AC-9).
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue({ get: () => null }),
+}));
+
+import { leads, visitorForwardHeaders } from "@working-theory/api-client";
+import { headers } from "next/headers";
 const mockSubmit = leads.submit as jest.Mock;
+const mockHeaders = headers as jest.Mock;
 
 afterEach(() => {
   jest.clearAllMocks();
+  mockHeaders.mockResolvedValue({ get: () => null });
 });
 
 function makeFormData(fields: Record<string, string>): FormData {
@@ -308,3 +321,51 @@ describe("captureLeadAction — honeypot (#6730)", () => {
     expect(body.payload.website).toBe("https://acme.example");
   });
 });
+
+// #7394 AC-9 — a spoke forwards its visitor to the hub's leads rate limit.
+describe("captureLeadAction — visitor forwarding (#7394)", () => {
+  const FORWARD_KEY = "0123456789abcdef".repeat(4); // gitleaks:allow — test fixture, not a credential (#7394)
+  const ENV_KEYS = ["AILK_VISITOR_FORWARD_KEY", "AILK_API_URL"] as const;
+  const priorEnv = new Map(ENV_KEYS.map((name) => [name, process.env[name]]));
+
+  beforeEach(() => {
+    process.env.AILK_VISITOR_FORWARD_KEY = FORWARD_KEY;
+    process.env.AILK_API_URL = "https://hub.example";
+  });
+
+  afterAll(() => {
+    for (const [name, value] of priorEnv) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  });
+
+  it("passes the helper's two headers as init", async () => {
+    const incoming = {
+      get: (name: string) => (name === "x-forwarded-for" ? "203.0.113.5" : null),
+    };
+    mockHeaders.mockResolvedValue(incoming);
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: { id: "lead_1", persisted: "db" } });
+
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+
+    expect(result).toEqual({ kind: "success" });
+    const expected = visitorForwardHeaders(incoming, FORWARD_KEY);
+    expect(expected).toEqual({
+      "x-ailk-visitor-ip": "203.0.113.5",
+      "x-ailk-visitor-forward-key": FORWARD_KEY,
+    });
+    expect(mockSubmit).toHaveBeenCalledWith(expect.any(Object), { headers: expected });
+  });
+
+  it("calls leads.submit with one argument when headers() throws, and still succeeds", async () => {
+    mockHeaders.mockRejectedValue(new Error("outside a request scope"));
+    mockSubmit.mockResolvedValueOnce({ ok: true, body: { id: "lead_1", persisted: "db" } });
+
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+
+    expect(result).toEqual({ kind: "success" });
+    expect(mockSubmit).toHaveBeenCalledTimes(1);
+    expect(mockSubmit.mock.calls[0]).toHaveLength(1);
+  });
+});

package/templates/apps/web/app/[locale]/contact/contact.actions.ts

@@ -35,11 +35,20 @@
  * a capability (lead capture) this repo already has an MCP twin for
  * (`ailkCaptureLead`). Absent (the real `<form>` never sets it) → defaults
  * to `"web"`, unchanged from before.
+ *
+ * Visitor forwarding (#7394): on a spoke whose API is a hub, the call
+ * carries the visitor's IP and the spoke's `AILK_VISITOR_FORWARD_KEY`
+ * (server-only, never `NEXT_PUBLIC_`) via `visitorForwardHeaders`, so the
+ * hub counts this lead against the visitor's own rate-limit budget instead
+ * of the spoke host's. No key, no client address, or headers that cannot be
+ * read → the call is made with one argument, exactly as before; a failure to
+ * read headers never blocks a submission.
  */
 
-import { leads } from "@working-theory/api-client";
+import { leads, visitorForwardHeaders } from "@working-theory/api-client";
 import { LEAD_CAPTURE_HONEYPOT, type LeadCaptureFormState } from "@working-theory/ui";
 import { submitLeadInputSchema } from "@working-theory/validation";
+import { headers } from "next/headers";
 
 const GENERIC_ERROR = "Something went wrong, please try again.";
 
@@ -131,8 +140,19 @@ export async function captureLeadAction(
     },
   };
 
+  let init: { headers: Record<string, string> } | undefined;
+  try {
+    const forwarded = visitorForwardHeaders(
+      await headers(),
+      process.env.AILK_VISITOR_FORWARD_KEY,
+    );
+    if (forwarded) init = { headers: forwarded };
+  } catch {
+    // No request scope to read — submit without forwarding.
+  }
+
   try {
-    const res = await leads.submit(body);
+    const res = init ? await leads.submit(body, init) : await leads.submit(body);
     if (!res.ok) {
       if (isNotConfigured(res)) return { kind: "unavailable" };
       return { kind: "error", message: GENERIC_ERROR };

package/templates/apps/web/app/[locale]/layout.tsx

@@ -5,6 +5,7 @@
 // Shell/Chrome composition — Nav + Footer wrap via @working-theory/templates MarketingShell (#2820)
 // Session-aware Nav actions — Sign in / Account + Sign out from the server-read session (#4984)
 // Auth route group — the marketing chrome is dropped on the five (auth) paths (#5963)
+// Account area — the marketing chrome AND the consent Banner are dropped on /account paths (#7430)
 // Site-declared theme — `_site.mdx` `theme:` block → token overlay → CSS vars
 //
 // Sits under app/[locale]/ and sets the <html lang> attribute to the
@@ -52,7 +53,7 @@ import {
   SignedInNav,
   type SignedInNavProps,
 } from "../../components/signed-in-nav";
-import { isAuthPath } from "../../lib/auth-routes";
+import { isAccountPath, isAuthPath } from "../../lib/auth-routes";
 import { assertEnabledLocale } from "../../lib/locale-guard";
 import { footerColumns, navItems } from "../../lib/nav-config";
 import { getOgImageUrl } from "../../lib/og";
@@ -395,6 +396,14 @@ export default async function LocaleLayout({
   // `(marketing)` group — a ~35-directory move for a five-page delta (spec D1).
   const isAuthRoute = isAuthPath(pathname, enabledLocales);
 
+  // The account branch (#7430, spec 7423 D4) — the same mechanism for the
+  // signed-in account area, which renders inside its own SignedInShell: no
+  // Nav, no Footer, no announcement Banner, and no cookie consent Banner
+  // either (the auth branch keeps that one). Cookie settings stay reachable
+  // from User settings › Privacy (`/privacy#cookie-settings`). The same
+  // fail-safe direction: an absent `x-pathname` keeps the full frame.
+  const isAccountRoute = isAccountPath(pathname, enabledLocales);
+
   // Every Nav prop that is safe to serialize — shared verbatim by the
   // server-rendered Nav (signed out) and `SignedInNav` (signed in), which adds
   // `navItems` and `renderFlowTrigger` on its own side of the RSC boundary.
@@ -553,14 +562,16 @@ export default async function LocaleLayout({
            * emitted unconditionally in OSS forks; paying customers install
            * @working-theory/branding and gate it in their own layout.
            */}
-          {isAuthRoute ? (
+          {isAuthRoute || isAccountRoute ? (
             /*
              * The (auth) branch (#5963): the five auth paths render their own
              * `(auth)/layout.tsx` — AuthShell — with no Nav and no marketing
              * Footer above or below it. Everything outside this ternary (the
              * document, the flash-prevention script, the theme vars, the
              * favicons, NextIntlClientProvider, the consent Banner and
-             * Telemetry) is shared by both branches and written once.
+             * Telemetry) is shared by both branches and written once. The
+             * account paths (#7430) take this branch too, and also skip the
+             * consent Banner below.
              */
             children
           ) : (
@@ -673,31 +684,33 @@ export default async function LocaleLayout({
            * reserves its own space (D1) and carries a close-without-choosing
            * control (D2) instead of a hard server-side hide.
            */}
-          <Banner
-            variant="info"
-            placement="bottom"
-            consentCookieName={CONSENT_COOKIE_NAME}
-            consentDecided={consentDecided}
-            title={tConsent("title")}
-            message={
-              <>
-                {tConsent("body")}{" "}
-                <Link
-                  href={localeHref(locale, "/privacy")}
-                  variant="unstyled"
-                  className="font-semibold text-current underline underline-offset-4"
-                >
-                  {tConsent("policyLinkLabel")}
-                </Link>
-              </>
-            }
-            dismissible={false}
-            dismissLabel={tConsent("dismissLabel")}
-            acceptLabel={tConsent("acceptLabel")}
-            secondaryAction={{ label: tConsent("rejectLabel") }}
-            rejectLabel={tConsent("rejectLabel")}
-            locale={locale}
-          />
+          {isAccountRoute ? null : (
+            <Banner
+              variant="info"
+              placement="bottom"
+              consentCookieName={CONSENT_COOKIE_NAME}
+              consentDecided={consentDecided}
+              title={tConsent("title")}
+              message={
+                <>
+                  {tConsent("body")}{" "}
+                  <Link
+                    href={localeHref(locale, "/privacy")}
+                    variant="unstyled"
+                    className="font-semibold text-current underline underline-offset-4"
+                  >
+                    {tConsent("policyLinkLabel")}
+                  </Link>
+                </>
+              }
+              dismissible={false}
+              dismissLabel={tConsent("dismissLabel")}
+              acceptLabel={tConsent("acceptLabel")}
+              secondaryAction={{ label: tConsent("rejectLabel") }}
+              rejectLabel={tConsent("rejectLabel")}
+              locale={locale}
+            />
+          )}
           <Telemetry />
         </NextIntlClientProvider>
       </body>

package/templates/apps/web/app/[locale]/newsletter/__tests__/newsletter.actions.test.ts

@@ -5,12 +5,25 @@
 
 import { subscribeNewsletterAction } from "../newsletter.actions.js";
 
+// `visitorForwardHeaders` stays real (#7394) so AC-9 compares the action's
+// `init` with the helper's own output.
 jest.mock("@working-theory/api-client", () => ({
   leads: { subscribe: jest.fn() },
+  visitorForwardHeaders: jest.requireActual("@working-theory/api-client")
+    .visitorForwardHeaders,
 }));
 
-import { leads } from "@working-theory/api-client";
+// next/headers' `headers()` is request-scoped in Next; outside it, it is
+// mocked here the way flow.actions.test.ts does (#7394 AC-9).
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue({ get: () => null }),
+}));
+
+import { leads, visitorForwardHeaders } from "@working-theory/api-client";
+import { headers } from "next/headers";
 const mockSubscribe = leads.subscribe as jest.Mock;
+const mockHeaders = headers as jest.Mock;
 
 function formWith(email: string): FormData {
   const fd = new FormData();
@@ -19,7 +32,10 @@ function formWith(email: string): FormData {
   return fd;
 }
 
-afterEach(() => jest.clearAllMocks());
+afterEach(() => {
+  jest.clearAllMocks();
+  mockHeaders.mockResolvedValue({ get: () => null });
+});
 
 describe("subscribeNewsletterAction", () => {
   it("calls leads.subscribe with source newsletter and the address", async () => {
@@ -73,3 +89,51 @@ describe("subscribeNewsletterAction", () => {
     expect(mockSubscribe).not.toHaveBeenCalled();
   });
 });
+
+// #7394 AC-9 — a spoke forwards its visitor to the hub's leads rate limit.
+describe("subscribeNewsletterAction — visitor forwarding (#7394)", () => {
+  const FORWARD_KEY = "0123456789abcdef".repeat(4); // gitleaks:allow — test fixture, not a credential (#7394)
+  const ENV_KEYS = ["AILK_VISITOR_FORWARD_KEY", "AILK_API_URL"] as const;
+  const priorEnv = new Map(ENV_KEYS.map((name) => [name, process.env[name]]));
+
+  beforeEach(() => {
+    process.env.AILK_VISITOR_FORWARD_KEY = FORWARD_KEY;
+    process.env.AILK_API_URL = "https://hub.example";
+  });
+
+  afterAll(() => {
+    for (const [name, value] of priorEnv) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  });
+
+  it("passes the helper's two headers as init", async () => {
+    const incoming = {
+      get: (name: string) => (name === "x-forwarded-for" ? "203.0.113.5" : null),
+    };
+    mockHeaders.mockResolvedValue(incoming);
+    mockSubscribe.mockResolvedValueOnce({ ok: true, body: { id: "subscr_1", persisted: "db" } });
+
+    const result = await subscribeNewsletterAction(null, formWith("ada@example.com"));
+
+    expect(result).toEqual({ kind: "success" });
+    const expected = visitorForwardHeaders(incoming, FORWARD_KEY);
+    expect(expected).toEqual({
+      "x-ailk-visitor-ip": "203.0.113.5",
+      "x-ailk-visitor-forward-key": FORWARD_KEY,
+    });
+    expect(mockSubscribe).toHaveBeenCalledWith(expect.any(Object), { headers: expected });
+  });
+
+  it("calls leads.subscribe with one argument when headers() throws, and still succeeds", async () => {
+    mockHeaders.mockRejectedValue(new Error("outside a request scope"));
+    mockSubscribe.mockResolvedValueOnce({ ok: true, body: { id: "subscr_1", persisted: "db" } });
+
+    const result = await subscribeNewsletterAction(null, formWith("ada@example.com"));
+
+    expect(result).toEqual({ kind: "success" });
+    expect(mockSubscribe).toHaveBeenCalledTimes(1);
+    expect(mockSubscribe.mock.calls[0]).toHaveLength(1);
+  });
+});