create-ailk 0.14.0 → 0.16.0

package/templates/apps/mcp/src/lib/topology.generated.ts

@@ -0,0 +1,24 @@
+// topology.generated.ts — how this MCP server resolves its workspace store.
+//
+// GENERATED by create-ailk for this site's topology (#7426). Do not edit:
+// every scaffold rewrites it. A hub resolves its workspace through the
+// database; a spoke (`--topology spoke`) has none, so its content tools
+// read the spoke's own MDX and its writes go to the hub at AILK_API_URL.
+import {
+  initMcpPublicWorkspace,
+  mcpPublicWorkspace,
+  type McpWorkspaceResolution,
+} from "./public-workspace.js";
+
+export { registerLicenseKeyStore } from "./license-key-store.js";
+export type { McpWorkspaceResolution };
+
+export const TOPOLOGY: "hub" | "spoke" = "hub";
+
+export async function initPublicWorkspace(): Promise<void> {
+  await initMcpPublicWorkspace();
+}
+
+export function publicWorkspace(): McpWorkspaceResolution {
+  return mcpPublicWorkspace();
+}

package/templates/apps/web/.env.example

@@ -93,17 +93,26 @@ CONTENT_ADAPTER=mdx
 # NEXT_PUBLIC_AILK_API_URL=http://localhost:3002
 
 # =============================================================================
-# Listicle directory (#7521) — server-side only, never NEXT_PUBLIC_
+# Listicle directory (#7521) — switched on by the site's listing key (#7872)
 # =============================================================================
 # The site's public listing key: the SAME value apps/api reads as
 # AILK_LISTING_PUBLIC_KEY (single-tenant) or holds as a SiteListingConfig
 # publicKey row (multi-tenant). Public by design — it names a site, it grants
-# nothing — but it is read on the server only. When it is set and the paid
-# @working-theory/ui-signal-collectors package is installed, the page a live
-# listicle names as its landing page shows that listicle's accepted entries,
-# and each entry gets a page at /<landingPage>/<slug>. Unset, no page reads
+# nothing. When it is set and the paid @working-theory/ui-signal-collectors
+# package is installed, the page a live listicle names as its landing page
+# shows that listicle's accepted entries, and each entry gets a page at
+# /<landingPage>/<slug>. Unset, the listings module is off and no page reads
 # the directory. One web deployment is one site: a hub's spokes are separate
 # web deployments, each with its own key.
+#
+# Two names, one reader (lib/listings-config.ts):
+#   1. NEXT_PUBLIC_AILK_LISTING_SITE_KEY wins when set. It is inlined into the
+#      build, so changing or rotating it needs a rebuild — and while it is set,
+#      a runtime change to AILK_LISTING_PUBLIC_KEY has no effect.
+#   2. AILK_LISTING_PUBLIC_KEY is the fallback (server-read), so a site
+#      configured before this name existed keeps its directory on upgrade.
+# An empty value counts as unset.
+# NEXT_PUBLIC_AILK_LISTING_SITE_KEY=
 # AILK_LISTING_PUBLIC_KEY=
 
 # =============================================================================
@@ -191,6 +200,36 @@ CONTENT_ADAPTER=mdx
 #
 # AILK_AUTH_TRUSTED_PROXIES=
 
+# =============================================================================
+# Sign-in through the hub — a spoke scaffolded with --hub-sign-in (#7894)
+# =============================================================================
+# A spoke has no database and no Better Auth of its own. With --hub-sign-in, a
+# visitor signs in on the HUB's own sign-in page and returns to this site's
+# /account; the hub-issued credential lives in a sealed, HttpOnly cookie. All
+# four are server-only — never rename one with a NEXT_PUBLIC_ prefix — and all
+# four must be set, or /account says sign-in is not available yet. The routes
+# under /api/hub-session answer 404 on any site not scaffolded in this mode.
+#
+# The hub's WEB origin (where its /sign-in lives), https: or http: on
+# localhost. create-ailk writes it to .env.local.
+# AILK_HUB_SIGN_IN_URL=https://hub.example.com
+#
+# This site's client id and secret, issued on the hub with
+#   pnpm --filter @working-theory/api spokes sign-in-client --id <spoke_id> \
+#     --redirect-uri <this site's origin>/api/hub-session/callback
+# The client id is the spoke's id. The secret is shown once; keep it out of git.
+# AILK_HUB_CLIENT_ID=
+# AILK_HUB_CLIENT_SECRET=
+#
+# This site's own cookie key material: at least 32 characters, generated per
+# site (create-ailk writes one to .env.local; `openssl rand -base64 32` makes
+# another). Never the client secret. Changing it signs every visitor out.
+# AILK_HUB_SESSION_SECRET=
+#
+# The redirect URI is built from this site's NEXT_PUBLIC_BASE_URL (else the
+# baseUrl in content/_site.mdx) — never from a request's Host — so set it to
+# the origin you registered on the hub.
+
 # =============================================================================
 # Observability
 # =============================================================================
@@ -228,3 +267,17 @@ CONTENT_ADAPTER=mdx
 # (see the relay block above, #7644), so the baseline CSP's
 # `connect-src 'self'` already covers them — no CSP extension is needed for
 # them, whatever NEXT_PUBLIC_AILK_API_URL is set to.
+#
+# On a SPOKE (create-ailk --topology spoke, #7872) this site has no apps/api:
+# /meet lists the meeting types the hub stores for this spoke's workspace and
+# books through the hub at AILK_API_URL with AILK_SPOKE_KEY. Then:
+#   - the FIRST segment (the owner) must name the provider account the hub
+#     uses for this spoke's workspace (its scheduling connection). It composes
+#     each booker's calLink; it is not an access control — the hub checks a
+#     spoke booking's slug, never its owner.
+#   - the SECOND segment is ignored: a workspace with no stored meeting-type
+#     list shows no meetings, because the hub books only a slug it stores.
+#   - the booker's two calls count against the relay's per-visitor budget,
+#     which holds per visitor only behind an edge that overwrites
+#     x-forwarded-for and x-real-ip (Vercel does); elsewhere every visitor
+#     shares one budget.

package/templates/apps/web/CLAUDE.md

@@ -139,6 +139,7 @@ A visitor's browser never calls the hub. Lead capture, newsletter signup, callba
 - **Only the list.** `RELAY_ROUTES` is the fixed set of (method, path) pairs: `POST /v1/leads/{submit,subscribe,callback}`, `GET /v1/schedule/availability`, `POST /v1/schedule/book`, `POST /v1/commerce/invoices`. Anything else is a 404 with no hub call. Adding a route is a reviewed change to that list, its test and `.env.example`.
 - **No cross-site POST.** A `Sec-Fetch-Site` other than `same-origin`, or an `Origin` not on this site's own host, is refused 403 before the hub is called.
 - **Headers are an allow-list.** The visitor's `x-forwarded-for` (else `x-real-ip`) and `user-agent` pass through so per-visitor rate limits still count each visitor; no `authorization`, client-sent `x-ailk-*` or `host` is forwarded, and a `cookie` goes only on `POST /v1/commerce/invoices`, the one session route.
+- **The relay has its own per-visitor budget (#7707).** Each visitor gets 8 calls per 10 minutes across the five visitor routes, and the session route (`POST /v1/commerce/invoices`) gets its own, wider budget of 30 per 10 minutes; the call that exceeds either gets `429 rate_limited` before any hub call. The budget is held in this instance's own process (no shared store, no env variable) and holds only where the site's edge overwrites `x-forwarded-for` and `x-real-ip` — Vercel does; a bare self-hosted Next server does not.
 - `/v1` is exempt from next-intl's locale rewrite in `middleware.ts`, as `/api` is.
 
 ## AEO & performance

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/hub-mode.test.tsx

@@ -0,0 +1,206 @@
+/**
+ * The account area on a spoke that signs in through its hub (#7894 D10, D12;
+ * spec docs/specs/7894-the-hub-signs-in-its-spec.md AC-5, AC-7).
+ *
+ * The generated web seam is mocked to its `signIn: "hub"` render: the
+ * session comes from `readSession`, `forwardedCookieInit()` re-targets to the
+ * hub credential, and `SIGN_IN_PROVIDER` is `"hub"`. It sits under
+ * `account/__tests__`, which a hub-mode spoke drops with the other account
+ * suites (spec 7894 D9), so it runs in this monorepo only.
+ *
+ * Covers:
+ *   - AC-7: with the hub answering 404 to the base reads (the hub credential
+ *     is admitted on none of them, D6), `loadInboxItems` loads `[]` for
+ *     `result` and `purchase` with `failed` false — an empty Inbox, never an
+ *     error row — and every read carries the Bearer credential, not a cookie.
+ *   - AC-5: the settings page renders no `NameForm` and no deletion request,
+ *     and links to `<AILK_HUB_SIGN_IN_URL>/account/settings` instead; Billing
+ *     is absent (its read answers 404).
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { render, screen } from "@testing-library/react";
+
+jest.mock("next-intl/server", () => {
+  const msgs: unknown = require("../../../../../messages/en.json");
+  const dig = (obj: unknown, path: string): unknown =>
+    path.split(".").reduce<unknown>(
+      (acc, k) => (acc !== null && typeof acc === "object" ? (acc as Record<string, unknown>)[k] : undefined),
+      obj,
+    );
+  return {
+    __esModule: true,
+    getTranslations: async (arg: string | { namespace?: string; locale?: string }) => {
+      const ns = typeof arg === "string" ? arg : (arg.namespace ?? "");
+      const messages = dig(msgs, ns);
+      return (key: string): string => {
+        const value = dig(messages, key);
+        return typeof value === "string" ? value : `${ns}.${key}`;
+      };
+    },
+  };
+});
+
+const mockHeaders = jest.fn();
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: (...args: unknown[]) => mockHeaders(...args),
+  cookies: jest.fn().mockResolvedValue({ toString: () => "" }),
+}));
+
+const mockReadSession = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: the seam is generated per build (#7894 D8); its `signIn: "hub"` render is the boundary under test, and no env or HTTP surface selects it.
+jest.mock("../../../../../lib/topology.generated", () => ({
+  __esModule: true,
+  TOPOLOGY: "spoke",
+  SIGN_IN_ENABLED: true,
+  SIGN_IN_PROVIDER: "hub",
+  SIGN_IN_PATH: "/account",
+  SIGN_UP_PATH: null,
+  SIGN_OUT_ENDPOINT: "/api/hub-session/sign-out",
+  readSession: (...args: unknown[]) => mockReadSession(...args),
+  registerSiteStores: () => Promise.resolve(),
+}));
+
+const mockLeadsSubmit = jest.fn();
+const notFound = { ok: false, status: 404, body: { ok: false, error: { code: "not_found", message: "Not found" } } };
+const mockWaitlistMe = jest.fn();
+const mockFlowCheckoutsMe = jest.fn();
+const mockSubscriptionMe = jest.fn();
+const mockMemberRead = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  waitlistSignups: { me: (...args: unknown[]) => mockWaitlistMe(...args) },
+  flowCheckouts: { me: (...args: unknown[]) => mockFlowCheckoutsMe(...args) },
+  subscription: {
+    me: (...args: unknown[]) => mockSubscriptionMe(...args),
+    portalSession: jest.fn(),
+  },
+  leads: { submit: (...args: unknown[]) => mockLeadsSubmit(...args) },
+  // #7920 — the member kinds read the hub with the credential; 404 here.
+  member: {
+    pieces: (...args: unknown[]) => mockMemberRead(...args),
+    messages: (...args: unknown[]) => mockMemberRead(...args),
+  },
+  visitorForwardHeaders: () => null,
+  hubSignIn: { me: jest.fn() },
+}));
+
+jest.mock("better-auth/react", () => ({
+  __esModule: true,
+  createAuthClient: () => ({ signOut: jest.fn(), updateUser: jest.fn() }),
+}));
+
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  useRouter: () => ({ push: jest.fn(), refresh: jest.fn() }),
+  usePathname: () => "/account/settings",
+  redirect: jest.fn(),
+}));
+
+import { seal } from "../../../../../lib/hub-session/seal";
+import { accountSession, loadInboxItems } from "../account-data";
+import { submitSupportRequest } from "../support-actions";
+import Page from "../settings/page";
+
+const HUB = "https://hub.example.com";
+const SESSION_SECRET = "s".repeat(43);
+const CREDENTIAL = `ailk_hst_${"t".repeat(43)}`;
+const USER = {
+  name: "Ada Lovelace",
+  email: "ada@example.com",
+  emailVerified: true,
+  createdAt: "2026-09-01T00:00:00.000Z",
+};
+
+const ENV = process.env;
+let contentRoot: string;
+
+beforeEach(() => {
+  contentRoot = mkdtempSync(join(tmpdir(), "ailk-hub-mode-"));
+  writeFileSync(join(contentRoot, "_site.mdx"), '---\nsiteName: "Test"\n---\n');
+  process.env = {
+    ...ENV,
+    AILK_CONTENT_ROOT: contentRoot,
+    AILK_HUB_SIGN_IN_URL: HUB,
+    AILK_HUB_CLIENT_ID: "spoke_0001",
+    AILK_HUB_CLIENT_SECRET: `ailk_hcs_${"c".repeat(43)}`,
+    AILK_HUB_SESSION_SECRET: SESSION_SECRET,
+    NEXT_PUBLIC_BASE_URL: "https://spoke.example.com",
+  };
+  const sealed = seal(
+    { v: 1, accessToken: CREDENTIAL, expiresAt: Date.now() + 60_000, user: USER },
+    SESSION_SECRET,
+    "session",
+    "__Host-ailk-hub-session",
+  );
+  mockHeaders.mockReset().mockResolvedValue(new Headers({ cookie: `__Host-ailk-hub-session=${sealed}` }));
+  mockReadSession.mockReset().mockResolvedValue({ user: USER });
+  mockWaitlistMe.mockReset().mockResolvedValue(notFound);
+  mockFlowCheckoutsMe.mockReset().mockResolvedValue(notFound);
+  mockSubscriptionMe.mockReset().mockResolvedValue(notFound);
+  mockMemberRead.mockReset().mockResolvedValue(notFound);
+});
+
+afterEach(() => {
+  rmSync(contentRoot, { recursive: true, force: true });
+  process.env = ENV;
+});
+
+describe("AC-7 — the base Inbox kinds on a hub-mode spoke", () => {
+  it("loads [] for result and purchase, with failed false, when the hub answers 404", async () => {
+    const session = await accountSession("en");
+    if (session === null) throw new Error("expected a session");
+    expect(session.ctx.init).toEqual({ headers: { authorization: `Bearer ${CREDENTIAL}` } });
+
+    const inbox = await loadInboxItems(session.ctx);
+    expect(inbox).toEqual({ items: [], failed: false });
+    expect(mockFlowCheckoutsMe).toHaveBeenCalledWith({
+      headers: { authorization: `Bearer ${CREDENTIAL}` },
+    });
+  });
+
+  it("has no session when the seam reads none", async () => {
+    mockReadSession.mockResolvedValue(null);
+    await expect(accountSession("en")).resolves.toBeNull();
+  });
+});
+
+describe("AC-5 — the settings page on a hub-mode spoke", () => {
+  async function renderPage(): Promise<void> {
+    render(await Page({ params: Promise.resolve({ locale: "en" }) }));
+  }
+
+  it("renders no NameForm and no deletion request, and links to the hub's account settings", async () => {
+    await renderPage();
+    expect(screen.queryByTestId("account-name-form")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("account-deletion-request")).not.toBeInTheDocument();
+    const href = `${HUB}/account/settings`;
+    expect(screen.getByTestId("account-settings-manage-on-hub")).toHaveAttribute("href", href);
+    expect(screen.getByTestId("account-privacy-manage-on-hub")).toHaveAttribute("href", href);
+    expect(screen.getByTestId("account-settings-name")).toHaveTextContent("Ada Lovelace");
+    expect(screen.getByText(/You sign in through our main site/)).toBeInTheDocument();
+  });
+
+  it("files a posted deletion request as a support request — the hub owns the account (SEC-7894-11)", async () => {
+    mockLeadsSubmit.mockResolvedValue({ ok: true, body: {} });
+    const form = new FormData();
+    form.set("kind", "deletion");
+    form.set("subject", "Delete me");
+    form.set("message", "Please delete my account.");
+    await expect(submitSupportRequest({ kind: "idle" }, form)).resolves.toEqual({ kind: "success" });
+    expect(mockLeadsSubmit).toHaveBeenCalledWith(
+      expect.objectContaining({ email: USER.email, payload: expect.objectContaining({ kind: "support" }) }),
+    );
+  });
+
+  it("omits Billing, whose read answers 404 for the hub credential", async () => {
+    await renderPage();
+    expect(document.getElementById("billing")).not.toBeInTheDocument();
+    expect(mockSubscriptionMe).toHaveBeenCalledWith({
+      headers: { authorization: `Bearer ${CREDENTIAL}` },
+    });
+  });
+});

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/page.test.tsx

@@ -17,6 +17,11 @@
  *      only: no For-you stack, no bottom sheet, no large title. The For you
  *      tab lists every For-you item in one inset card, and ✕ dismisses one.
  *      At `md`+ only the Inbox panel shows (the aside holds For you).
+ *   7. #7920 — the member area's `piece` and `message` kinds and the
+ *      needs-client For-you source. Each reads the hub with `ctx.init`
+ *      unchanged (the caller's own credential); 404 and an unverified 401/403
+ *      load `[]`, any other failure rejects (D12). With no hub credential on
+ *      `ctx.init` — a cookie-session site — they make no call and load `[]`.
  */
 import { fireEvent, render, screen, within } from "@testing-library/react";
 
@@ -64,11 +69,17 @@ jest.mock("../../../../../auth", () => ({
 const mockSignupMe = jest.fn();
 const mockCheckoutsMe = jest.fn();
 const mockSubscriptionMe = jest.fn();
+const mockMemberPieces = jest.fn();
+const mockMemberMessages = jest.fn();
 jest.mock("@working-theory/api-client", () => ({
   __esModule: true,
   waitlistSignups: { me: (...args: unknown[]) => mockSignupMe(...args) },
   flowCheckouts: { me: (...args: unknown[]) => mockCheckoutsMe(...args) },
   subscription: { me: (...args: unknown[]) => mockSubscriptionMe(...args) },
+  member: {
+    pieces: (...args: unknown[]) => mockMemberPieces(...args),
+    messages: (...args: unknown[]) => mockMemberMessages(...args),
+  },
 }));
 
 const mockRefresh = jest.fn();
@@ -78,9 +89,18 @@ jest.mock("next/navigation", () => ({
   usePathname: () => "/account",
 }));
 
-import { PhoneTabProvider } from "@working-theory/templates/account";
-
-import { accountExperimentKeys } from "../../../../../lib/account-config";
+import {
+  PhoneTabProvider,
+  type AccountContext,
+  type AccountTranslate,
+} from "@working-theory/templates/account";
+import { getTranslations } from "next-intl/server";
+
+import {
+  accountExperimentKeys,
+  accountForYouSources,
+  accountInboxKinds,
+} from "../../../../../lib/account-config";
 import Page from "../page";
 
 const SESSION = {
@@ -121,6 +141,80 @@ const NO_SUBSCRIPTION = {
   body: { actionRequired: false, status: null, accessRevokesAt: null, portalAvailable: false },
 };
 
+const PIECE = {
+  id: "piece_01920000-0000-7000-8000-000000000001",
+  title: "Spring newsletter",
+  stage: "Drafting",
+  needsClient: false,
+  createdAt: "2026-09-05T09:00:00.000Z",
+  updatedAt: "2026-09-06T09:00:00.000Z",
+};
+
+const PIECE_NEEDS_CLIENT = {
+  id: "piece_01920000-0000-7000-8000-000000000002",
+  title: "About page",
+  stage: "Review",
+  needsClient: true,
+  createdAt: "2026-09-02T09:00:00.000Z",
+  updatedAt: "2026-09-07T09:00:00.000Z",
+};
+
+const MESSAGE = {
+  id: "intx_01920000-0000-7000-8000-000000000003",
+  subject: "Kickoff notes",
+  body: "Thanks for the call.",
+  file: null,
+  createdAt: "2026-09-08T09:00:00.000Z",
+  readAt: null,
+};
+
+const MESSAGE_WITH_FILE = {
+  id: "intx_01920000-0000-7000-8000-000000000004",
+  subject: "Your brand guide",
+  body: "Attached.",
+  file: { filename: "brand-guide.pdf", contentType: "application/pdf" },
+  createdAt: "2026-09-09T09:00:00.000Z",
+  readAt: "2026-09-09T10:00:00.000Z",
+};
+
+/** The hub credential a spoke signed in through its hub forwards (#7894 D12). */
+const BEARER = { headers: { authorization: `Bearer ailk_hst_${"t".repeat(43)}` } };
+
+const notFound = { ok: false, status: 404, body: { ok: false, error: { code: "not_found", message: "Not found" } } };
+
+/** The context a hub-mode spoke hands every contribution, signed in. */
+async function memberCtx(
+  overrides: Partial<AccountContext> = {},
+): Promise<AccountContext> {
+  const locale = overrides.locale ?? "en";
+  // The contract's translator takes any key (account-data.ts's reasoning):
+  // forward through the mock's runtime signature.
+  const translate = (await getTranslations({ locale, namespace: "account" })) as (
+    key: string,
+    values?: Record<string, unknown>,
+  ) => string;
+  const t: AccountTranslate = (key, values) => translate(key, values);
+  return {
+    locale,
+    user: { name: "Ada", email: "ada@example.com", emailVerified: true },
+    t,
+    init: BEARER,
+    ...overrides,
+  };
+}
+
+function kindOf(id: string): (typeof accountInboxKinds)[number] {
+  const kind = accountInboxKinds.find((k) => k.kind === id);
+  if (!kind) throw new Error(`no ${id} kind`);
+  return kind;
+}
+
+function needsClientSource(): (typeof accountForYouSources)[number] {
+  const source = accountForYouSources.find((s) => s.id === "piece-needs-client");
+  if (!source) throw new Error("no piece-needs-client source");
+  return source;
+}
+
 /** Renders the page on a phone tab — the frame's PhoneTabProvider. */
 async function renderPage(locale = "en", tab = "inbox"): Promise<void> {
   const element = await Page({ params: Promise.resolve({ locale }) });
@@ -144,6 +238,8 @@ beforeEach(() => {
   mockSignupMe.mockReset().mockResolvedValue({ ok: true, body: SIGNUP });
   mockCheckoutsMe.mockReset().mockResolvedValue({ ok: true, body: [CHECKOUT] });
   mockSubscriptionMe.mockReset().mockResolvedValue(NO_SUBSCRIPTION);
+  mockMemberPieces.mockReset().mockResolvedValue({ ok: true, body: { items: [PIECE, PIECE_NEEDS_CLIENT] } });
+  mockMemberMessages.mockReset().mockResolvedValue({ ok: true, body: { items: [MESSAGE, MESSAGE_WITH_FILE] } });
   mockRefresh.mockReset();
 });
 
@@ -375,3 +471,160 @@ describe("Hub unavailable (D12)", () => {
     expect(within(panel).queryByTestId("inbox-error")).not.toBeInTheDocument();
   });
 });
+
+describe("the member kinds — piece and message (#7920, spec 7423 D8 · D12)", () => {
+  it("declares piece and message as Inbox kinds in the updates section, labelled from the account namespace", async () => {
+    const ctx = await memberCtx();
+    expect(kindOf("piece").section).toBe("updates");
+    expect(kindOf("message").section).toBe("updates");
+    expect(ctx.t(kindOf("piece").label)).toBe("My pieces");
+    expect(ctx.t(kindOf("message").label)).toBe("My messages");
+  });
+
+  it("each kind reads the hub with ctx.init unchanged — the caller's own credential", async () => {
+    const ctx = await memberCtx();
+    const pieces = await kindOf("piece").load(ctx);
+    const messages = await kindOf("message").load(ctx);
+    expect(mockMemberPieces).toHaveBeenCalledWith(BEARER);
+    expect(mockMemberMessages).toHaveBeenCalledWith(BEARER);
+    expect(pieces.map((p) => [p.id, p.title, p.at])).toEqual([
+      [PIECE.id, "Spring newsletter", PIECE.updatedAt],
+      [PIECE_NEEDS_CLIENT.id, "About page", PIECE_NEEDS_CLIENT.updatedAt],
+    ]);
+    expect(messages.map((m) => [m.id, m.title, m.at])).toEqual([
+      [MESSAGE.id, "Kickoff notes", MESSAGE.createdAt],
+      [MESSAGE_WITH_FILE.id, "Your brand guide", MESSAGE_WITH_FILE.createdAt],
+    ]);
+  });
+
+  it.each(["piece", "message"])("%s loads [] on a 404 — nothing for this caller", async (id) => {
+    mockMemberPieces.mockResolvedValue(notFound);
+    mockMemberMessages.mockResolvedValue(notFound);
+    await expect(kindOf(id).load(await memberCtx())).resolves.toEqual([]);
+  });
+
+  it.each([
+    ["piece", 401],
+    ["piece", 403],
+    ["message", 401],
+    ["message", 403],
+  ])("%s loads [] on a %i while the email is unverified", async (id, status) => {
+    const refusal = { ok: false, status, body: { ok: false, error: { code: "email_unverified" } } };
+    mockMemberPieces.mockResolvedValue(refusal);
+    mockMemberMessages.mockResolvedValue(refusal);
+    const ctx = await memberCtx({ user: { name: "Ada", email: "ada@example.com", emailVerified: false } });
+    await expect(kindOf(id).load(ctx)).resolves.toEqual([]);
+  });
+
+  it.each([
+    ["piece", 401],
+    ["piece", 403],
+    ["piece", 500],
+    ["piece", 0],
+    ["message", 401],
+    ["message", 403],
+    ["message", 502],
+    ["message", 0],
+  ])("%s rejects on a %i for a verified email — never a partial list shown as whole", async (id, status) => {
+    const failure = {
+      ok: false,
+      status,
+      body: { ok: false, error: { code: status === 0 ? "insecure_transport" : "failed", message: "x" } },
+    };
+    mockMemberPieces.mockResolvedValue(failure);
+    mockMemberMessages.mockResolvedValue(failure);
+    await expect(kindOf(id).load(await memberCtx())).rejects.toMatchObject({ status });
+  });
+
+  it("with no hub credential on ctx.init (a cookie-session site) both kinds and the source load [] without a call", async () => {
+    const ctx = await memberCtx({ init: { headers: { cookie: "session=abc" } } });
+    await expect(kindOf("piece").load(ctx)).resolves.toEqual([]);
+    await expect(kindOf("message").load(ctx)).resolves.toEqual([]);
+    await expect(needsClientSource().load(ctx)).resolves.toEqual([]);
+    expect(mockMemberPieces).not.toHaveBeenCalled();
+    expect(mockMemberMessages).not.toHaveBeenCalled();
+  });
+
+  it("the cookie-session Inbox stays as it was: no member rows, no error row, no member call", async () => {
+    await renderPage();
+    expect(screen.queryByTestId("inbox-error")).not.toBeInTheDocument();
+    expect(screen.queryByText("Spring newsletter")).not.toBeInTheDocument();
+    expect(screen.queryByText("Kickoff notes")).not.toBeInTheDocument();
+    expect(mockMemberPieces).not.toHaveBeenCalled();
+    expect(mockMemberMessages).not.toHaveBeenCalled();
+  });
+
+  it("a piece's detail shows its stage and dates", async () => {
+    const ctx = await memberCtx();
+    const [first] = await kindOf("piece").load(ctx);
+    const detail = kindOf("piece").renderDetail(first!, ctx);
+    expect(detail.status).toBe("Drafting");
+    expect(detail.fields?.heading).toBe("My pieces");
+    expect(detail.fields?.items.map((i) => i.label)).toEqual(["Stage", "Started", "Updated"]);
+  });
+
+  it("a message with an asset shows a file action that opens the member file read", async () => {
+    const ctx = await memberCtx();
+    const items = await kindOf("message").load(ctx);
+    const withFile = items.find((m) => m.id === MESSAGE_WITH_FILE.id)!;
+    const detail = kindOf("message").renderDetail(withFile, ctx);
+    expect(detail.actions).toEqual([
+      {
+        key: "file",
+        label: "Download brand-guide.pdf",
+        variant: "default",
+        href: `/account/inbox/message/${MESSAGE_WITH_FILE.id}/file`,
+      },
+    ]);
+    expect(detail.fields?.items).toContainEqual({ label: "File", value: "brand-guide.pdf" });
+  });
+
+  it("the file action carries the locale prefix off the default locale", async () => {
+    const ctx = await memberCtx({ locale: "fr" });
+    const items = await kindOf("message").load(ctx);
+    const withFile = items.find((m) => m.id === MESSAGE_WITH_FILE.id)!;
+    expect(kindOf("message").renderDetail(withFile, ctx).actions?.[0]?.href).toBe(
+      `/fr/account/inbox/message/${MESSAGE_WITH_FILE.id}/file`,
+    );
+  });
+
+  it("a message without an asset has no file action", async () => {
+    const ctx = await memberCtx();
+    const [plain] = await kindOf("message").load(ctx);
+    const detail = kindOf("message").renderDetail(plain!, ctx);
+    expect(detail.actions).toBeUndefined();
+    expect(detail.fields?.items.map((i) => i.label)).not.toContain("File");
+  });
+});
+
+describe("the needs-client For-you source (#7920)", () => {
+  it("a needsClient piece is a needs-you For-you item with an Open action to its Inbox row", async () => {
+    const items = await needsClientSource().load(await memberCtx());
+    expect(items).toEqual([
+      {
+        id: `piece:${PIECE_NEEDS_CLIENT.id}`,
+        type: { id: "piece", label: "Piece", tone: "needs-you" },
+        title: "About page",
+        time: { kind: "at", at: PIECE_NEEDS_CLIENT.updatedAt },
+        action: { kind: "open", href: `/account/inbox/piece/${PIECE_NEEDS_CLIENT.id}` },
+        dismissible: true,
+      },
+    ]);
+    expect(mockMemberPieces).toHaveBeenCalledWith(BEARER);
+  });
+
+  it("off the default locale the Open href carries the prefix", async () => {
+    const [item] = await needsClientSource().load(await memberCtx({ locale: "fr" }));
+    expect(item?.action).toEqual({
+      kind: "open",
+      href: `/fr/account/inbox/piece/${PIECE_NEEDS_CLIENT.id}`,
+    });
+  });
+
+  it("loads [] on a 404 and rejects on any other failure", async () => {
+    mockMemberPieces.mockResolvedValue(notFound);
+    await expect(needsClientSource().load(await memberCtx())).resolves.toEqual([]);
+    mockMemberPieces.mockResolvedValue({ ok: false, status: 500, body: {} });
+    await expect(needsClientSource().load(await memberCtx())).rejects.toMatchObject({ status: 500 });
+  });
+});

package/templates/apps/web/app/[locale]/(authed)/account/account-data.ts

@@ -34,9 +34,9 @@ import { headers } from "next/headers";
 import { getTranslations } from "next-intl/server";
 import { cache, createElement } from "react";
 
-import { auth } from "../../../../auth";
 import { accountForYouSources, accountInboxKinds } from "../../../../lib/account-config";
 import { forwardedCookieInit } from "../../../../lib/server-api";
+import { readSession } from "../../../../lib/topology.generated";
 
 /** The session's person, plus what the frame shows beyond the contract. */
 export interface AccountSession {
@@ -48,18 +48,15 @@ export interface AccountSession {
 /** The `AccountContext` for this request, or `null` when there is no session. */
 export const accountSession = cache(
   async (locale: string): Promise<AccountSession | null> => {
-    const session = await auth.api.getSession({ headers: await headers() });
+    // Through the generated seam (#7894 D10): Better Auth on a hub, the sealed
+    // hub-session cookie on a spoke that signs in through its hub.
+    const session = await readSession(await headers());
     if (!session) return null;
     // The contract's translator takes any key: a contribution's keys (a
     // kind's `label`, a section's `title`) are data, which next-intl's
     // literal-key typing cannot see. The runtime call is the same function.
     const t = (await getTranslations({ locale, namespace: "account" })) as unknown as AccountTranslate;
-    const { name, email, emailVerified, createdAt } = session.user as {
-      name?: string | null;
-      email: string;
-      emailVerified: boolean;
-      createdAt?: Date | string | null;
-    };
+    const { name, email, emailVerified, createdAt } = session.user;
     return {
       ctx: {
         locale,