create-ailk 0.15.0 → 0.17.0

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/hub-mode.test.tsx

@@ -0,0 +1,206 @@
+/**
+ * The account area on a spoke that signs in through its hub (#7894 D10, D12;
+ * spec docs/specs/7894-the-hub-signs-in-its-spec.md AC-5, AC-7).
+ *
+ * The generated web seam is mocked to its `signIn: "hub"` render: the
+ * session comes from `readSession`, `forwardedCookieInit()` re-targets to the
+ * hub credential, and `SIGN_IN_PROVIDER` is `"hub"`. It sits under
+ * `account/__tests__`, which a hub-mode spoke drops with the other account
+ * suites (spec 7894 D9), so it runs in this monorepo only.
+ *
+ * Covers:
+ *   - AC-7: with the hub answering 404 to the base reads (the hub credential
+ *     is admitted on none of them, D6), `loadInboxItems` loads `[]` for
+ *     `result` and `purchase` with `failed` false — an empty Inbox, never an
+ *     error row — and every read carries the Bearer credential, not a cookie.
+ *   - AC-5: the settings page renders no `NameForm` and no deletion request,
+ *     and links to `<AILK_HUB_SIGN_IN_URL>/account/settings` instead; Billing
+ *     is absent (its read answers 404).
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { render, screen } from "@testing-library/react";
+
+jest.mock("next-intl/server", () => {
+  const msgs: unknown = require("../../../../../messages/en.json");
+  const dig = (obj: unknown, path: string): unknown =>
+    path.split(".").reduce<unknown>(
+      (acc, k) => (acc !== null && typeof acc === "object" ? (acc as Record<string, unknown>)[k] : undefined),
+      obj,
+    );
+  return {
+    __esModule: true,
+    getTranslations: async (arg: string | { namespace?: string; locale?: string }) => {
+      const ns = typeof arg === "string" ? arg : (arg.namespace ?? "");
+      const messages = dig(msgs, ns);
+      return (key: string): string => {
+        const value = dig(messages, key);
+        return typeof value === "string" ? value : `${ns}.${key}`;
+      };
+    },
+  };
+});
+
+const mockHeaders = jest.fn();
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: (...args: unknown[]) => mockHeaders(...args),
+  cookies: jest.fn().mockResolvedValue({ toString: () => "" }),
+}));
+
+const mockReadSession = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: the seam is generated per build (#7894 D8); its `signIn: "hub"` render is the boundary under test, and no env or HTTP surface selects it.
+jest.mock("../../../../../lib/topology.generated", () => ({
+  __esModule: true,
+  TOPOLOGY: "spoke",
+  SIGN_IN_ENABLED: true,
+  SIGN_IN_PROVIDER: "hub",
+  SIGN_IN_PATH: "/account",
+  SIGN_UP_PATH: null,
+  SIGN_OUT_ENDPOINT: "/api/hub-session/sign-out",
+  readSession: (...args: unknown[]) => mockReadSession(...args),
+  registerSiteStores: () => Promise.resolve(),
+}));
+
+const mockLeadsSubmit = jest.fn();
+const notFound = { ok: false, status: 404, body: { ok: false, error: { code: "not_found", message: "Not found" } } };
+const mockWaitlistMe = jest.fn();
+const mockFlowCheckoutsMe = jest.fn();
+const mockSubscriptionMe = jest.fn();
+const mockMemberRead = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  waitlistSignups: { me: (...args: unknown[]) => mockWaitlistMe(...args) },
+  flowCheckouts: { me: (...args: unknown[]) => mockFlowCheckoutsMe(...args) },
+  subscription: {
+    me: (...args: unknown[]) => mockSubscriptionMe(...args),
+    portalSession: jest.fn(),
+  },
+  leads: { submit: (...args: unknown[]) => mockLeadsSubmit(...args) },
+  // #7920 — the member kinds read the hub with the credential; 404 here.
+  member: {
+    pieces: (...args: unknown[]) => mockMemberRead(...args),
+    messages: (...args: unknown[]) => mockMemberRead(...args),
+  },
+  visitorForwardHeaders: () => null,
+  hubSignIn: { me: jest.fn() },
+}));
+
+jest.mock("better-auth/react", () => ({
+  __esModule: true,
+  createAuthClient: () => ({ signOut: jest.fn(), updateUser: jest.fn() }),
+}));
+
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  useRouter: () => ({ push: jest.fn(), refresh: jest.fn() }),
+  usePathname: () => "/account/settings",
+  redirect: jest.fn(),
+}));
+
+import { seal } from "../../../../../lib/hub-session/seal";
+import { accountSession, loadInboxItems } from "../account-data";
+import { submitSupportRequest } from "../support-actions";
+import Page from "../settings/page";
+
+const HUB = "https://hub.example.com";
+const SESSION_SECRET = "s".repeat(43);
+const CREDENTIAL = `ailk_hst_${"t".repeat(43)}`;
+const USER = {
+  name: "Ada Lovelace",
+  email: "ada@example.com",
+  emailVerified: true,
+  createdAt: "2026-09-01T00:00:00.000Z",
+};
+
+const ENV = process.env;
+let contentRoot: string;
+
+beforeEach(() => {
+  contentRoot = mkdtempSync(join(tmpdir(), "ailk-hub-mode-"));
+  writeFileSync(join(contentRoot, "_site.mdx"), '---\nsiteName: "Test"\n---\n');
+  process.env = {
+    ...ENV,
+    AILK_CONTENT_ROOT: contentRoot,
+    AILK_HUB_SIGN_IN_URL: HUB,
+    AILK_HUB_CLIENT_ID: "spoke_0001",
+    AILK_HUB_CLIENT_SECRET: `ailk_hcs_${"c".repeat(43)}`,
+    AILK_HUB_SESSION_SECRET: SESSION_SECRET,
+    NEXT_PUBLIC_BASE_URL: "https://spoke.example.com",
+  };
+  const sealed = seal(
+    { v: 1, accessToken: CREDENTIAL, expiresAt: Date.now() + 60_000, user: USER },
+    SESSION_SECRET,
+    "session",
+    "__Host-ailk-hub-session",
+  );
+  mockHeaders.mockReset().mockResolvedValue(new Headers({ cookie: `__Host-ailk-hub-session=${sealed}` }));
+  mockReadSession.mockReset().mockResolvedValue({ user: USER });
+  mockWaitlistMe.mockReset().mockResolvedValue(notFound);
+  mockFlowCheckoutsMe.mockReset().mockResolvedValue(notFound);
+  mockSubscriptionMe.mockReset().mockResolvedValue(notFound);
+  mockMemberRead.mockReset().mockResolvedValue(notFound);
+});
+
+afterEach(() => {
+  rmSync(contentRoot, { recursive: true, force: true });
+  process.env = ENV;
+});
+
+describe("AC-7 — the base Inbox kinds on a hub-mode spoke", () => {
+  it("loads [] for result and purchase, with failed false, when the hub answers 404", async () => {
+    const session = await accountSession("en");
+    if (session === null) throw new Error("expected a session");
+    expect(session.ctx.init).toEqual({ headers: { authorization: `Bearer ${CREDENTIAL}` } });
+
+    const inbox = await loadInboxItems(session.ctx);
+    expect(inbox).toEqual({ items: [], failed: false });
+    expect(mockFlowCheckoutsMe).toHaveBeenCalledWith({
+      headers: { authorization: `Bearer ${CREDENTIAL}` },
+    });
+  });
+
+  it("has no session when the seam reads none", async () => {
+    mockReadSession.mockResolvedValue(null);
+    await expect(accountSession("en")).resolves.toBeNull();
+  });
+});
+
+describe("AC-5 — the settings page on a hub-mode spoke", () => {
+  async function renderPage(): Promise<void> {
+    render(await Page({ params: Promise.resolve({ locale: "en" }) }));
+  }
+
+  it("renders no NameForm and no deletion request, and links to the hub's account settings", async () => {
+    await renderPage();
+    expect(screen.queryByTestId("account-name-form")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("account-deletion-request")).not.toBeInTheDocument();
+    const href = `${HUB}/account/settings`;
+    expect(screen.getByTestId("account-settings-manage-on-hub")).toHaveAttribute("href", href);
+    expect(screen.getByTestId("account-privacy-manage-on-hub")).toHaveAttribute("href", href);
+    expect(screen.getByTestId("account-settings-name")).toHaveTextContent("Ada Lovelace");
+    expect(screen.getByText(/You sign in through our main site/)).toBeInTheDocument();
+  });
+
+  it("files a posted deletion request as a support request — the hub owns the account (SEC-7894-11)", async () => {
+    mockLeadsSubmit.mockResolvedValue({ ok: true, body: {} });
+    const form = new FormData();
+    form.set("kind", "deletion");
+    form.set("subject", "Delete me");
+    form.set("message", "Please delete my account.");
+    await expect(submitSupportRequest({ kind: "idle" }, form)).resolves.toEqual({ kind: "success" });
+    expect(mockLeadsSubmit).toHaveBeenCalledWith(
+      expect.objectContaining({ email: USER.email, payload: expect.objectContaining({ kind: "support" }) }),
+    );
+  });
+
+  it("omits Billing, whose read answers 404 for the hub credential", async () => {
+    await renderPage();
+    expect(document.getElementById("billing")).not.toBeInTheDocument();
+    expect(mockSubscriptionMe).toHaveBeenCalledWith({
+      headers: { authorization: `Bearer ${CREDENTIAL}` },
+    });
+  });
+});

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/page.test.tsx

@@ -17,6 +17,11 @@
  *      only: no For-you stack, no bottom sheet, no large title. The For you
  *      tab lists every For-you item in one inset card, and ✕ dismisses one.
  *      At `md`+ only the Inbox panel shows (the aside holds For you).
+ *   7. #7920 — the member area's `piece` and `message` kinds and the
+ *      needs-client For-you source. Each reads the hub with `ctx.init`
+ *      unchanged (the caller's own credential); 404 and an unverified 401/403
+ *      load `[]`, any other failure rejects (D12). With no hub credential on
+ *      `ctx.init` — a cookie-session site — they make no call and load `[]`.
  */
 import { fireEvent, render, screen, within } from "@testing-library/react";
 
@@ -64,11 +69,17 @@ jest.mock("../../../../../auth", () => ({
 const mockSignupMe = jest.fn();
 const mockCheckoutsMe = jest.fn();
 const mockSubscriptionMe = jest.fn();
+const mockMemberPieces = jest.fn();
+const mockMemberMessages = jest.fn();
 jest.mock("@working-theory/api-client", () => ({
   __esModule: true,
   waitlistSignups: { me: (...args: unknown[]) => mockSignupMe(...args) },
   flowCheckouts: { me: (...args: unknown[]) => mockCheckoutsMe(...args) },
   subscription: { me: (...args: unknown[]) => mockSubscriptionMe(...args) },
+  member: {
+    pieces: (...args: unknown[]) => mockMemberPieces(...args),
+    messages: (...args: unknown[]) => mockMemberMessages(...args),
+  },
 }));
 
 const mockRefresh = jest.fn();
@@ -78,9 +89,18 @@ jest.mock("next/navigation", () => ({
   usePathname: () => "/account",
 }));
 
-import { PhoneTabProvider } from "@working-theory/templates/account";
-
-import { accountExperimentKeys } from "../../../../../lib/account-config";
+import {
+  PhoneTabProvider,
+  type AccountContext,
+  type AccountTranslate,
+} from "@working-theory/templates/account";
+import { getTranslations } from "next-intl/server";
+
+import {
+  accountExperimentKeys,
+  accountForYouSources,
+  accountInboxKinds,
+} from "../../../../../lib/account-config";
 import Page from "../page";
 
 const SESSION = {
@@ -121,6 +141,80 @@ const NO_SUBSCRIPTION = {
   body: { actionRequired: false, status: null, accessRevokesAt: null, portalAvailable: false },
 };
 
+const PIECE = {
+  id: "piece_01920000-0000-7000-8000-000000000001",
+  title: "Spring newsletter",
+  stage: "Drafting",
+  needsClient: false,
+  createdAt: "2026-09-05T09:00:00.000Z",
+  updatedAt: "2026-09-06T09:00:00.000Z",
+};
+
+const PIECE_NEEDS_CLIENT = {
+  id: "piece_01920000-0000-7000-8000-000000000002",
+  title: "About page",
+  stage: "Review",
+  needsClient: true,
+  createdAt: "2026-09-02T09:00:00.000Z",
+  updatedAt: "2026-09-07T09:00:00.000Z",
+};
+
+const MESSAGE = {
+  id: "intx_01920000-0000-7000-8000-000000000003",
+  subject: "Kickoff notes",
+  body: "Thanks for the call.",
+  file: null,
+  createdAt: "2026-09-08T09:00:00.000Z",
+  readAt: null,
+};
+
+const MESSAGE_WITH_FILE = {
+  id: "intx_01920000-0000-7000-8000-000000000004",
+  subject: "Your brand guide",
+  body: "Attached.",
+  file: { filename: "brand-guide.pdf", contentType: "application/pdf" },
+  createdAt: "2026-09-09T09:00:00.000Z",
+  readAt: "2026-09-09T10:00:00.000Z",
+};
+
+/** The hub credential a spoke signed in through its hub forwards (#7894 D12). */
+const BEARER = { headers: { authorization: `Bearer ailk_hst_${"t".repeat(43)}` } };
+
+const notFound = { ok: false, status: 404, body: { ok: false, error: { code: "not_found", message: "Not found" } } };
+
+/** The context a hub-mode spoke hands every contribution, signed in. */
+async function memberCtx(
+  overrides: Partial<AccountContext> = {},
+): Promise<AccountContext> {
+  const locale = overrides.locale ?? "en";
+  // The contract's translator takes any key (account-data.ts's reasoning):
+  // forward through the mock's runtime signature.
+  const translate = (await getTranslations({ locale, namespace: "account" })) as (
+    key: string,
+    values?: Record<string, unknown>,
+  ) => string;
+  const t: AccountTranslate = (key, values) => translate(key, values);
+  return {
+    locale,
+    user: { name: "Ada", email: "ada@example.com", emailVerified: true },
+    t,
+    init: BEARER,
+    ...overrides,
+  };
+}
+
+function kindOf(id: string): (typeof accountInboxKinds)[number] {
+  const kind = accountInboxKinds.find((k) => k.kind === id);
+  if (!kind) throw new Error(`no ${id} kind`);
+  return kind;
+}
+
+function needsClientSource(): (typeof accountForYouSources)[number] {
+  const source = accountForYouSources.find((s) => s.id === "piece-needs-client");
+  if (!source) throw new Error("no piece-needs-client source");
+  return source;
+}
+
 /** Renders the page on a phone tab — the frame's PhoneTabProvider. */
 async function renderPage(locale = "en", tab = "inbox"): Promise<void> {
   const element = await Page({ params: Promise.resolve({ locale }) });
@@ -144,6 +238,8 @@ beforeEach(() => {
   mockSignupMe.mockReset().mockResolvedValue({ ok: true, body: SIGNUP });
   mockCheckoutsMe.mockReset().mockResolvedValue({ ok: true, body: [CHECKOUT] });
   mockSubscriptionMe.mockReset().mockResolvedValue(NO_SUBSCRIPTION);
+  mockMemberPieces.mockReset().mockResolvedValue({ ok: true, body: { items: [PIECE, PIECE_NEEDS_CLIENT] } });
+  mockMemberMessages.mockReset().mockResolvedValue({ ok: true, body: { items: [MESSAGE, MESSAGE_WITH_FILE] } });
   mockRefresh.mockReset();
 });
 
@@ -375,3 +471,160 @@ describe("Hub unavailable (D12)", () => {
     expect(within(panel).queryByTestId("inbox-error")).not.toBeInTheDocument();
   });
 });
+
+describe("the member kinds — piece and message (#7920, spec 7423 D8 · D12)", () => {
+  it("declares piece and message as Inbox kinds in the updates section, labelled from the account namespace", async () => {
+    const ctx = await memberCtx();
+    expect(kindOf("piece").section).toBe("updates");
+    expect(kindOf("message").section).toBe("updates");
+    expect(ctx.t(kindOf("piece").label)).toBe("My pieces");
+    expect(ctx.t(kindOf("message").label)).toBe("My messages");
+  });
+
+  it("each kind reads the hub with ctx.init unchanged — the caller's own credential", async () => {
+    const ctx = await memberCtx();
+    const pieces = await kindOf("piece").load(ctx);
+    const messages = await kindOf("message").load(ctx);
+    expect(mockMemberPieces).toHaveBeenCalledWith(BEARER);
+    expect(mockMemberMessages).toHaveBeenCalledWith(BEARER);
+    expect(pieces.map((p) => [p.id, p.title, p.at])).toEqual([
+      [PIECE.id, "Spring newsletter", PIECE.updatedAt],
+      [PIECE_NEEDS_CLIENT.id, "About page", PIECE_NEEDS_CLIENT.updatedAt],
+    ]);
+    expect(messages.map((m) => [m.id, m.title, m.at])).toEqual([
+      [MESSAGE.id, "Kickoff notes", MESSAGE.createdAt],
+      [MESSAGE_WITH_FILE.id, "Your brand guide", MESSAGE_WITH_FILE.createdAt],
+    ]);
+  });
+
+  it.each(["piece", "message"])("%s loads [] on a 404 — nothing for this caller", async (id) => {
+    mockMemberPieces.mockResolvedValue(notFound);
+    mockMemberMessages.mockResolvedValue(notFound);
+    await expect(kindOf(id).load(await memberCtx())).resolves.toEqual([]);
+  });
+
+  it.each([
+    ["piece", 401],
+    ["piece", 403],
+    ["message", 401],
+    ["message", 403],
+  ])("%s loads [] on a %i while the email is unverified", async (id, status) => {
+    const refusal = { ok: false, status, body: { ok: false, error: { code: "email_unverified" } } };
+    mockMemberPieces.mockResolvedValue(refusal);
+    mockMemberMessages.mockResolvedValue(refusal);
+    const ctx = await memberCtx({ user: { name: "Ada", email: "ada@example.com", emailVerified: false } });
+    await expect(kindOf(id).load(ctx)).resolves.toEqual([]);
+  });
+
+  it.each([
+    ["piece", 401],
+    ["piece", 403],
+    ["piece", 500],
+    ["piece", 0],
+    ["message", 401],
+    ["message", 403],
+    ["message", 502],
+    ["message", 0],
+  ])("%s rejects on a %i for a verified email — never a partial list shown as whole", async (id, status) => {
+    const failure = {
+      ok: false,
+      status,
+      body: { ok: false, error: { code: status === 0 ? "insecure_transport" : "failed", message: "x" } },
+    };
+    mockMemberPieces.mockResolvedValue(failure);
+    mockMemberMessages.mockResolvedValue(failure);
+    await expect(kindOf(id).load(await memberCtx())).rejects.toMatchObject({ status });
+  });
+
+  it("with no hub credential on ctx.init (a cookie-session site) both kinds and the source load [] without a call", async () => {
+    const ctx = await memberCtx({ init: { headers: { cookie: "session=abc" } } });
+    await expect(kindOf("piece").load(ctx)).resolves.toEqual([]);
+    await expect(kindOf("message").load(ctx)).resolves.toEqual([]);
+    await expect(needsClientSource().load(ctx)).resolves.toEqual([]);
+    expect(mockMemberPieces).not.toHaveBeenCalled();
+    expect(mockMemberMessages).not.toHaveBeenCalled();
+  });
+
+  it("the cookie-session Inbox stays as it was: no member rows, no error row, no member call", async () => {
+    await renderPage();
+    expect(screen.queryByTestId("inbox-error")).not.toBeInTheDocument();
+    expect(screen.queryByText("Spring newsletter")).not.toBeInTheDocument();
+    expect(screen.queryByText("Kickoff notes")).not.toBeInTheDocument();
+    expect(mockMemberPieces).not.toHaveBeenCalled();
+    expect(mockMemberMessages).not.toHaveBeenCalled();
+  });
+
+  it("a piece's detail shows its stage and dates", async () => {
+    const ctx = await memberCtx();
+    const [first] = await kindOf("piece").load(ctx);
+    const detail = kindOf("piece").renderDetail(first!, ctx);
+    expect(detail.status).toBe("Drafting");
+    expect(detail.fields?.heading).toBe("My pieces");
+    expect(detail.fields?.items.map((i) => i.label)).toEqual(["Stage", "Started", "Updated"]);
+  });
+
+  it("a message with an asset shows a file action that opens the member file read", async () => {
+    const ctx = await memberCtx();
+    const items = await kindOf("message").load(ctx);
+    const withFile = items.find((m) => m.id === MESSAGE_WITH_FILE.id)!;
+    const detail = kindOf("message").renderDetail(withFile, ctx);
+    expect(detail.actions).toEqual([
+      {
+        key: "file",
+        label: "Download brand-guide.pdf",
+        variant: "default",
+        href: `/account/inbox/message/${MESSAGE_WITH_FILE.id}/file`,
+      },
+    ]);
+    expect(detail.fields?.items).toContainEqual({ label: "File", value: "brand-guide.pdf" });
+  });
+
+  it("the file action carries the locale prefix off the default locale", async () => {
+    const ctx = await memberCtx({ locale: "fr" });
+    const items = await kindOf("message").load(ctx);
+    const withFile = items.find((m) => m.id === MESSAGE_WITH_FILE.id)!;
+    expect(kindOf("message").renderDetail(withFile, ctx).actions?.[0]?.href).toBe(
+      `/fr/account/inbox/message/${MESSAGE_WITH_FILE.id}/file`,
+    );
+  });
+
+  it("a message without an asset has no file action", async () => {
+    const ctx = await memberCtx();
+    const [plain] = await kindOf("message").load(ctx);
+    const detail = kindOf("message").renderDetail(plain!, ctx);
+    expect(detail.actions).toBeUndefined();
+    expect(detail.fields?.items.map((i) => i.label)).not.toContain("File");
+  });
+});
+
+describe("the needs-client For-you source (#7920)", () => {
+  it("a needsClient piece is a needs-you For-you item with an Open action to its Inbox row", async () => {
+    const items = await needsClientSource().load(await memberCtx());
+    expect(items).toEqual([
+      {
+        id: `piece:${PIECE_NEEDS_CLIENT.id}`,
+        type: { id: "piece", label: "Piece", tone: "needs-you" },
+        title: "About page",
+        time: { kind: "at", at: PIECE_NEEDS_CLIENT.updatedAt },
+        action: { kind: "open", href: `/account/inbox/piece/${PIECE_NEEDS_CLIENT.id}` },
+        dismissible: true,
+      },
+    ]);
+    expect(mockMemberPieces).toHaveBeenCalledWith(BEARER);
+  });
+
+  it("off the default locale the Open href carries the prefix", async () => {
+    const [item] = await needsClientSource().load(await memberCtx({ locale: "fr" }));
+    expect(item?.action).toEqual({
+      kind: "open",
+      href: `/fr/account/inbox/piece/${PIECE_NEEDS_CLIENT.id}`,
+    });
+  });
+
+  it("loads [] on a 404 and rejects on any other failure", async () => {
+    mockMemberPieces.mockResolvedValue(notFound);
+    await expect(needsClientSource().load(await memberCtx())).resolves.toEqual([]);
+    mockMemberPieces.mockResolvedValue({ ok: false, status: 500, body: {} });
+    await expect(needsClientSource().load(await memberCtx())).rejects.toMatchObject({ status: 500 });
+  });
+});

package/templates/apps/web/app/[locale]/(authed)/account/account-data.ts

@@ -34,9 +34,9 @@ import { headers } from "next/headers";
 import { getTranslations } from "next-intl/server";
 import { cache, createElement } from "react";
 
-import { auth } from "../../../../auth";
 import { accountForYouSources, accountInboxKinds } from "../../../../lib/account-config";
 import { forwardedCookieInit } from "../../../../lib/server-api";
+import { readSession } from "../../../../lib/topology.generated";
 
 /** The session's person, plus what the frame shows beyond the contract. */
 export interface AccountSession {
@@ -48,18 +48,15 @@ export interface AccountSession {
 /** The `AccountContext` for this request, or `null` when there is no session. */
 export const accountSession = cache(
   async (locale: string): Promise<AccountSession | null> => {
-    const session = await auth.api.getSession({ headers: await headers() });
+    // Through the generated seam (#7894 D10): Better Auth on a hub, the sealed
+    // hub-session cookie on a spoke that signs in through its hub.
+    const session = await readSession(await headers());
     if (!session) return null;
     // The contract's translator takes any key: a contribution's keys (a
     // kind's `label`, a section's `title`) are data, which next-intl's
     // literal-key typing cannot see. The runtime call is the same function.
     const t = (await getTranslations({ locale, namespace: "account" })) as unknown as AccountTranslate;
-    const { name, email, emailVerified, createdAt } = session.user as {
-      name?: string | null;
-      email: string;
-      emailVerified: boolean;
-      createdAt?: Date | string | null;
-    };
+    const { name, email, emailVerified, createdAt } = session.user;
     return {
       ctx: {
         locale,