create-ailk 0.15.0 → 0.17.0

package/templates/apps/web/app/[locale]/(authed)/account/inbox/message/[id]/file/__tests__/route.test.ts

@@ -0,0 +1,205 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * The member file read, re-served by the spoke (#7920; SEC-7877-D) —
+ * `GET /[locale]/account/inbox/message/:id/file`.
+ *
+ * A message's file action links here: the browser holds neither the hub
+ * credential (sealed in the `hub-session` cookie) nor the spoke key, so the
+ * spoke's server reads `GET /v1/member/messages/:id/file` with
+ * `forwardedCookieInit()` and streams the bytes back. The api-client's
+ * `member.messageFile` is the one external boundary mocked; the seal, the
+ * cookie read and the route's decisions are real. Covers:
+ *   - a 404 unless the web seam's `SIGN_IN_PROVIDER` is `"hub"`, no hub call;
+ *   - the read carries the signed-in caller's own credential, and the bytes
+ *     come back with all five hub headers unchanged;
+ *   - a hub answer missing any of the five is refused 502 — never bytes on
+ *     this origin without them;
+ *   - refusals map to a status with no body and `private, no-store`.
+ */
+
+const mockMessageFile = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  member: { messageFile: (...args: unknown[]) => mockMessageFile(...args) },
+}));
+
+const mockProvider: { value: "site" | "hub" | "none" } = { value: "hub" };
+// eslint-disable-next-line no-restricted-syntax -- #507: the sign-in provider is a generated constant (#7894 D8), not a runtime input; the seam IS the boundary between a hub and a hub-mode spoke build, and no env or HTTP surface selects it.
+jest.mock("../../../../../../../../../lib/topology.generated", () => ({
+  __esModule: true,
+  get SIGN_IN_PROVIDER() {
+    return mockProvider.value;
+  },
+}));
+
+const mockHeaders = jest.fn();
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: (...args: unknown[]) => mockHeaders(...args),
+  cookies: jest.fn().mockResolvedValue({ toString: () => "" }),
+}));
+
+import { seal } from "../../../../../../../../../lib/hub-session/seal";
+import { GET } from "../route";
+
+const ENV = process.env;
+const SITE = "https://spoke.example.com";
+const SESSION_SECRET = "s".repeat(43);
+const COOKIE = "__Host-ailk-hub-session";
+const CREDENTIAL = `ailk_hst_${"t".repeat(43)}`;
+const ID = "intx_01920000-0000-7000-8000-000000000004";
+
+const FILE_HEADERS = {
+  contentType: "application/pdf",
+  contentDisposition: 'attachment; filename="brand-guide.pdf"',
+  contentTypeOptions: "nosniff",
+  contentSecurityPolicy: "default-src 'none'; sandbox",
+  cacheControl: "private, no-store",
+};
+
+function fileResult(headers: Partial<Record<keyof typeof FILE_HEADERS, string | null>> = {}) {
+  return {
+    ok: true,
+    body: {
+      stream: new Response("%PDF-1.7 bytes").body,
+      headers: { ...FILE_HEADERS, ...headers },
+    },
+  };
+}
+
+function signedIn(): void {
+  const sealed = seal(
+    {
+      v: 1,
+      accessToken: CREDENTIAL,
+      expiresAt: Date.now() + 60_000,
+      user: { name: "Ada", email: "ada@example.com", emailVerified: true, createdAt: "2026-09-01T00:00:00.000Z" },
+    },
+    SESSION_SECRET,
+    "session",
+    COOKIE,
+  );
+  mockHeaders.mockResolvedValue(new Headers({ cookie: `${COOKIE}=${sealed}` }));
+}
+
+function get(id = ID): Promise<Response> {
+  return GET(new Request(`${SITE}/account/inbox/message/${id}/file`), {
+    params: Promise.resolve({ locale: "en", id }),
+  });
+}
+
+beforeEach(() => {
+  process.env = {
+    ...ENV,
+    AILK_HUB_SIGN_IN_URL: "https://hub.example.com",
+    AILK_HUB_CLIENT_ID: "spoke_0001",
+    AILK_HUB_CLIENT_SECRET: `ailk_hcs_${"c".repeat(43)}`,
+    AILK_HUB_SESSION_SECRET: SESSION_SECRET,
+    NEXT_PUBLIC_BASE_URL: SITE,
+  };
+  mockProvider.value = "hub";
+  mockHeaders.mockReset().mockResolvedValue(new Headers());
+  mockMessageFile.mockReset().mockResolvedValue(fileResult());
+});
+
+afterAll(() => {
+  process.env = ENV;
+});
+
+describe("the member file read on a spoke that signs in through its hub", () => {
+  it("reads the file with the caller's own credential and re-serves it with all five headers unchanged", async () => {
+    signedIn();
+    const res = await get();
+    expect(mockMessageFile).toHaveBeenCalledWith(ID, {
+      headers: { authorization: `Bearer ${CREDENTIAL}` },
+    });
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toBe(FILE_HEADERS.contentType);
+    expect(res.headers.get("content-disposition")).toBe(FILE_HEADERS.contentDisposition);
+    expect(res.headers.get("x-content-type-options")).toBe(FILE_HEADERS.contentTypeOptions);
+    expect(res.headers.get("content-security-policy")).toBe(FILE_HEADERS.contentSecurityPolicy);
+    expect(res.headers.get("cache-control")).toBe(FILE_HEADERS.cacheControl);
+    await expect(res.text()).resolves.toBe("%PDF-1.7 bytes");
+  });
+
+  it.each(Object.keys(FILE_HEADERS) as (keyof typeof FILE_HEADERS)[])(
+    "refuses 502 with no bytes when the hub's answer lacks %s",
+    async (name) => {
+      signedIn();
+      const result = fileResult({ [name]: null });
+      const cancel = jest.spyOn(result.body.stream as ReadableStream, "cancel");
+      mockMessageFile.mockResolvedValue(result);
+      const refused = await get();
+      expect(refused.status).toBe(502);
+      expect(cancel).toHaveBeenCalled();
+      expect(refused.headers.get("cache-control")).toBe("private, no-store");
+      expect(refused.headers.get("content-disposition")).toBeNull();
+      await expect(refused.text()).resolves.toBe("");
+    },
+  );
+
+  it("signed out, the read goes with no credential and its refusal answers 401", async () => {
+    mockMessageFile.mockResolvedValue({
+      ok: false,
+      status: 0,
+      body: { ok: false, error: { code: "unauthorized", message: "No usable credential" } },
+    });
+    const res = await get();
+    expect(mockMessageFile).toHaveBeenCalledWith(ID, { headers: {} });
+    expect(res.status).toBe(401);
+    expect(res.headers.get("cache-control")).toBe("private, no-store");
+    await expect(res.text()).resolves.toBe("");
+  });
+
+  it.each([
+    [404, 404],
+    [401, 401],
+    [403, 403],
+    [429, 429],
+    [500, 502],
+    [503, 502],
+  ])("a hub %i answers %i, with no body", async (hubStatus, status) => {
+    signedIn();
+    mockMessageFile.mockResolvedValue({
+      ok: false,
+      status: hubStatus,
+      body: { ok: false, error: { code: "x", message: "x" } },
+    });
+    const res = await get();
+    expect(res.status).toBe(status);
+    expect(res.headers.get("cache-control")).toBe("private, no-store");
+    await expect(res.text()).resolves.toBe("");
+  });
+
+  it("an API base the api-client refuses (insecure_transport) answers 502", async () => {
+    signedIn();
+    mockMessageFile.mockResolvedValue({
+      ok: false,
+      status: 0,
+      body: { ok: false, error: { code: "insecure_transport", message: "x" } },
+    });
+    expect((await get()).status).toBe(502);
+  });
+
+  it("a hub call that throws (network failure, a redirect under redirect: error) answers 502 with no body", async () => {
+    signedIn();
+    mockMessageFile.mockRejectedValue(new TypeError("fetch failed"));
+    const res = await get();
+    expect(res.status).toBe(502);
+    expect(res.headers.get("cache-control")).toBe("private, no-store");
+    await expect(res.text()).resolves.toBe("");
+  });
+});
+
+describe("on a site that does not sign in through a hub", () => {
+  it.each(["site", "none"] as const)("SIGN_IN_PROVIDER %s answers 404 and calls nothing", async (provider) => {
+    mockProvider.value = provider;
+    signedIn();
+    const res = await get();
+    expect(res.status).toBe(404);
+    expect(mockMessageFile).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/web/app/[locale]/(authed)/account/inbox/message/[id]/file/route.ts

@@ -0,0 +1,82 @@
+/**
+ * The member file read, re-served (#7920) — `GET /[locale]/account/inbox/message/:id/file`.
+ *
+ * A message's file action (the `message` Inbox kind, `lib/account-config.ts`)
+ * links here. The browser holds neither the client's hub credential (sealed in
+ * the `hub-session` cookie) nor this site's spoke key, so this route reads the
+ * hub's `GET /v1/member/messages/:id/file` with `forwardedCookieInit()` — the
+ * caller's own credential, so a client only ever gets their own file — and
+ * streams the bytes back unread.
+ *
+ * SEC-7877-D (the obligation in `@working-theory/api-client`'s `member.ts`):
+ * the bytes go out with all five hub headers UNCHANGED — `Content-Type`,
+ * `Content-Disposition` (attachment), `X-Content-Type-Options: nosniff`, the
+ * sandbox `Content-Security-Policy` and `Cache-Control: private, no-store` —
+ * so the file is never a document on this origin and never cached on the way.
+ * A hub answer missing any of the five is refused 502 rather than served
+ * without it.
+ *
+ * Only a spoke that signs in through its hub (`SIGN_IN_PROVIDER === "hub"`,
+ * #7894) carries the credential; anywhere else this is a 404 with no call.
+ * A refusal has no body: no credential (signed out) is a 401, a hub 4xx keeps
+ * its status, and a hub 5xx, a transport the api-client refuses or a hub call
+ * that throws is a 502.
+ */
+import { member, type MemberFileHeaders } from "@working-theory/api-client";
+
+import { forwardedCookieInit } from "../../../../../../../../lib/server-api";
+import { SIGN_IN_PROVIDER } from "../../../../../../../../lib/topology.generated";
+
+interface Context {
+  params: Promise<{ locale: string; id: string }>;
+}
+
+/** The response header each of the five hub headers goes out under. */
+const FILE_HEADER_NAMES: Record<keyof MemberFileHeaders, string> = {
+  contentType: "Content-Type",
+  contentDisposition: "Content-Disposition",
+  contentTypeOptions: "X-Content-Type-Options",
+  contentSecurityPolicy: "Content-Security-Policy",
+  cacheControl: "Cache-Control",
+};
+
+function refusal(status: number): Response {
+  return new Response(null, { status, headers: { "Cache-Control": "private, no-store" } });
+}
+
+/** The refusal's status, from the api-client's `{ ok: false, status, body }`. */
+function refusalStatus(status: number, body: unknown): number {
+  if (status === 0) {
+    const code = (body as { error?: { code?: unknown } } | null)?.error?.code;
+    return code === "unauthorized" ? 401 : 502;
+  }
+  return status >= 500 ? 502 : status;
+}
+
+// platform-decisions-waiver: api-versioning — a page-scoped download link on the site's own account area, not an API contract; it re-serves the versioned hub route /v1/member/messages/:id/file
+export async function GET(_request: Request, { params }: Context): Promise<Response> {
+  if (SIGN_IN_PROVIDER !== "hub") return refusal(404);
+  const { id } = await params;
+
+  // The api-client throws, rather than answering `{ ok: false }`, on a
+  // network failure or a redirect — that is a 502 too, never Next's own 500.
+  let res: Awaited<ReturnType<typeof member.messageFile>>;
+  try {
+    res = await member.messageFile(id, await forwardedCookieInit());
+  } catch {
+    return refusal(502);
+  }
+  if (!res.ok) return refusal(refusalStatus(res.status, res.body));
+
+  const { stream, headers } = res.body;
+  const out = new Headers();
+  for (const [key, name] of Object.entries(FILE_HEADER_NAMES) as [keyof MemberFileHeaders, string][]) {
+    const value = headers[key];
+    if (value === null) {
+      await stream.cancel();
+      return refusal(502);
+    }
+    out.set(name, value);
+  }
+  return new Response(stream, { status: 200, headers: out });
+}

package/templates/apps/web/app/[locale]/(authed)/account/settings/page.tsx

@@ -21,6 +21,13 @@
  *     401/403/404 (the commerce-disabled build answers 404).
  *   - Then any section a module contributes (`accountSettingsSections`).
  *
+ * On a spoke that signs in through its hub (`SIGN_IN_PROVIDER === "hub"`,
+ * #7894 D10) the account belongs to the hub: the name is a read-only row,
+ * Security says sign-in happens on the hub, and both the name edit and the
+ * deletion request are a link to the hub's own account settings — so a
+ * request about a hub account never lands in this spoke's inbox
+ * (SEC-7894-11). Billing is absent there because its read answers 404.
+ *
  * No Credentials, Scope, Organizations or Credits section: those are an
  * agent's or an operator's (§5.12a), never a member's.
  */
@@ -35,6 +42,8 @@ import type { ReactElement, ReactNode } from "react";
 
 import { accountSettingsSections } from "../../../../../lib/account-config";
 import { getActiveProviderIds } from "../../../../../lib/auth-env";
+import { hubSessionConfig } from "../../../../../lib/hub-session/config";
+import { SIGN_IN_PROVIDER } from "../../../../../lib/topology.generated";
 import { accountSession, logReadFailure } from "../account-data";
 import { openBillingPortal } from "../actions";
 
@@ -95,6 +104,31 @@ const METHOD_KEYS: Record<string, string> = {
   email: "settings.security.password",
 };
 
+/** The hub's own account settings page, on a spoke that signs in through it. */
+function hubSettingsHref(): string | null {
+  const config = hubSessionConfig();
+  return config === null ? null : new URL("/account/settings", config.hubOrigin).toString();
+}
+
+/** A link to the hub's account settings, in place of a control that would act on the spoke. */
+function HubSettingsLink({
+  href,
+  label,
+  testId,
+}: {
+  href: string;
+  label: string;
+  testId: string;
+}): ReactElement {
+  return (
+    <div>
+      <Link href={href} className="inline-flex min-h-6 items-center" data-testid={testId}>
+        {label}
+      </Link>
+    </div>
+  );
+}
+
 /** The statuses with a message key; any other renders as the API sent it. */
 const KNOWN_STATUSES: ReadonlySet<string> = new Set(["trialing", "active", "past_due", "canceled"]);
 
@@ -140,6 +174,8 @@ export default async function AccountSettingsPage({ params }: Props): Promise<Re
   const sub = await readSubscription(ctx.init);
   const showBilling = sub !== null && (sub.status !== null || sub.portalAvailable);
   const methods = getActiveProviderIds().filter((id) => id in METHOD_KEYS);
+  const viaHub = SIGN_IN_PROVIDER === "hub";
+  const hubHref = viaHub ? hubSettingsHref() : null;
 
   return (
     <div className="flex max-w-3xl flex-col gap-8 py-8" data-testid="account-settings">
@@ -175,26 +211,49 @@ export default async function AccountSettingsPage({ params }: Props): Promise<Re
               value: ctx.user.email,
               "data-testid": "account-settings-email",
             },
+            ...(viaHub && ctx.user.name
+              ? [
+                  {
+                    label: t("settings.general.name"),
+                    value: ctx.user.name,
+                    "data-testid": "account-settings-name",
+                  },
+                ]
+              : []),
           ]}
         />
-        <NameForm
-          initialName={ctx.user.name ?? ""}
-          labels={{
-            name: t("settings.general.name"),
-            placeholder: t("settings.general.namePlaceholder"),
-            save: t("settings.general.save"),
-            saving: t("settings.general.saving"),
-            saved: t("settings.general.saved"),
-            unsaved: t("settings.general.unsaved"),
-            clean: t("settings.general.clean"),
-            required: t("settings.general.nameRequired"),
-            error: t("settings.general.saveError"),
-          }}
-        />
+        {viaHub ? (
+          hubHref !== null ? (
+            <HubSettingsLink
+              href={hubHref}
+              label={t("settings.general.manageOnHub")}
+              testId="account-settings-manage-on-hub"
+            />
+          ) : null
+        ) : (
+          <NameForm
+            initialName={ctx.user.name ?? ""}
+            labels={{
+              name: t("settings.general.name"),
+              placeholder: t("settings.general.namePlaceholder"),
+              save: t("settings.general.save"),
+              saving: t("settings.general.saving"),
+              saved: t("settings.general.saved"),
+              unsaved: t("settings.general.unsaved"),
+              clean: t("settings.general.clean"),
+              required: t("settings.general.nameRequired"),
+              error: t("settings.general.saveError"),
+            }}
+          />
+        )}
       </Section>
 
       <Section id="security" title={t("settings.security.title")} lead={t("settings.security.lead")}>
-        {methods.length > 0 ? (
+        {viaHub ? (
+          <Text as="p" variant="body-sm" tone="muted">
+            {t("settings.security.viaHub")}
+          </Text>
+        ) : methods.length > 0 ? (
           <div className="flex flex-col gap-2">
             <Text as="p" variant="body-sm" className="font-medium">
               {t("settings.security.methods")}
@@ -234,20 +293,30 @@ export default async function AccountSettingsPage({ params }: Props): Promise<Re
             {t("settings.privacy.cookies")}
           </Link>
         </div>
-        <div className="flex flex-col gap-2">
-          <Text as="p" variant="body-sm" tone="muted">
-            {t("settings.privacy.deletionLead")}
-          </Text>
-          <DeletionRequest
-            labels={{
-              action: t("settings.privacy.deletion"),
-              subject: t("settings.privacy.deletionSubject"),
-              message: t("settings.privacy.deletionMessage"),
-              sent: t("settings.privacy.deletionSent"),
-              error: t("settings.privacy.deletionError"),
-            }}
-          />
-        </div>
+        {viaHub ? (
+          hubHref !== null ? (
+            <HubSettingsLink
+              href={hubHref}
+              label={t("settings.general.manageOnHub")}
+              testId="account-privacy-manage-on-hub"
+            />
+          ) : null
+        ) : (
+          <div className="flex flex-col gap-2">
+            <Text as="p" variant="body-sm" tone="muted">
+              {t("settings.privacy.deletionLead")}
+            </Text>
+            <DeletionRequest
+              labels={{
+                action: t("settings.privacy.deletion"),
+                subject: t("settings.privacy.deletionSubject"),
+                message: t("settings.privacy.deletionMessage"),
+                sent: t("settings.privacy.deletionSent"),
+                error: t("settings.privacy.deletionError"),
+              }}
+            />
+          </div>
+        )}
       </Section>
 
       {showBilling ? (

package/templates/apps/web/app/[locale]/(authed)/account/support-actions.ts

@@ -21,7 +21,7 @@
 import { leads, visitorForwardHeaders } from "@working-theory/api-client";
 import { headers } from "next/headers";
 
-import { auth } from "../../../../auth";
+import { SIGN_IN_PROVIDER, readSession } from "../../../../lib/topology.generated";
 
 /** PII-safe error identity for logs (the `checkout.actions.ts` idiom: `err.name` only). */
 function errorName(err: unknown): string {
@@ -61,7 +61,10 @@ export async function submitSupportRequest(
   _prev: SupportRequestState,
   formData: FormData,
 ): Promise<SupportRequestState> {
-  const kind = field(formData, "kind") === "deletion" ? "deletion" : "support";
+  // A hub sign-in spoke's account belongs to the hub, whose own settings take
+  // a deletion request (#7894 D10, SEC-7894-11): here it can only be support.
+  const kind =
+    field(formData, "kind") === "deletion" && SIGN_IN_PROVIDER !== "hub" ? "deletion" : "support";
   const subject = field(formData, "subject");
   const message = field(formData, "message");
   if (!subject || !message || subject.length > MAX_SUBJECT || message.length > MAX_MESSAGE) {
@@ -70,7 +73,7 @@ export async function submitSupportRequest(
 
   try {
     const requestHeaders = await headers();
-    const session = await auth.api.getSession({ headers: requestHeaders });
+    const session = await readSession(requestHeaders);
     if (!session) return { kind: "error", reason: "failed" };
 
     const body = {

package/templates/apps/web/app/[locale]/(authed)/layout.tsx

@@ -1,54 +1,29 @@
 /**
  * (authed) segment layout — the operator-dashboard session guard (#4665 D9).
  *
- * RSC: reads the active Better Auth session via `auth.api.getSession`
- * (mirrors `apps-paid/admin/app/(authed)/layout.tsx`). With no session it
- * renders `SignInGate` — the dashboard's own front door — rather than
+ * RSC: reads the session through the generated topology seam's `readSession`
+ * (#7894 D10) — Better Auth's `auth.api.getSession` on a hub, the sealed
+ * hub-session cookie on a spoke that signs in through its hub. With no
+ * session it renders the generated gate seam's `SignedOutGate` rather than
  * redirecting (a `redirect("/sign-in")` would render the visitor's requested
- * path only as a query param; rendering the gate in place keeps the URL, and
- * the gate itself links to `/sign-in?next=<path>` for the full sign-in
- * surface — #4984). This guard reads no public-route auth-requirement flag
- * (spec Clarifications) — that flag governs whether PUBLIC marketing routes
+ * path only as a query param; rendering the gate in place keeps the URL —
+ * #4984). This guard reads no public-route auth-requirement flag (spec
+ * Clarifications) — that flag governs whether PUBLIC marketing routes
  * redirect; tenant signup data is never public, so this gate always applies.
  *
- * The gate's providers are resolved HERE, on the server, and passed down as a
- * prop (#7419): `SignInGate` is a client component, and the provider env
- * `getActiveProviderIds()` reads is server-only — read in the browser it is
- * always empty, which made every gated page claim sign-in was not configured.
- *
- * When the email sign-in link is on (#7435 § D9 — the same
- * `getActiveProviderIds()` predicate `auth.ts` registers the plugin on), the
- * layout resolves `/sign-in`'s card copy here too and passes it as the gate's
- * `emailLink` prop; otherwise it passes nothing and the gate renders as before.
- *
- * On an account path (#7430, `isAccountPath` on the forwarded `x-pathname`)
- * the visitor is a member, not an operator: the gate reads the member-facing
- * `account.gate` copy instead of `waitlistDashboard.gate` (which asks for
- * provider env vars "to enable operator access"). When no sign-in method is
- * on, the layout renders that member gate itself so its headline is a real
- * `<h1>` — `SignInGate`'s not-configured branch renders `EmptyState`, whose
- * headline is a `<p>` — and its one action leads back to the site rather than
- * to a sign-in page that has nothing to offer. An absent `x-pathname` keeps
- * the operator copy, the same fail-safe direction as the locale layout's
- * account branch.
+ * What the gate renders is the seam's (`signed-out-gate.generated.tsx`): on a
+ * hub, the operator `SignInGate` or, on an account path, the member gate
+ * (#7419, #7430, #7435); on a hub sign-in spoke, the hub-session gate. This
+ * layout therefore imports neither `auth.ts` nor the `(auth)` group, so a
+ * spoke that keeps its account area keeps this layout too (spec 7894 D9).
  */
 
-import { localeHref } from "@working-theory/ui";
-import { Button, Heading, Link, Text } from "@working-theory/ui/primitives";
-import type { AuthPanelProvider } from "@working-theory/ui/sections";
-import { readLocales } from "@working-theory/web-i18n";
 import { headers } from "next/headers";
-import { getTranslations } from "next-intl/server";
 import type { ReactElement, ReactNode } from "react";
 
-import { resolveSignInCardText } from "../(auth)/sign-in/sign-in-text";
-import { auth } from "../../../auth";
-import { getActiveProviderIds } from "../../../lib/auth-env";
-import { isAccountPath } from "../../../lib/auth-routes";
-
-import { SignInGate } from "./sign-in-gate";
+import { readSession } from "../../../lib/topology.generated";
 
-const SUPPORTED_PROVIDERS: readonly AuthPanelProvider[] = ["google", "github"];
+import { SignedOutGate } from "./signed-out-gate.generated";
 
 interface Props {
   children: ReactNode;
@@ -61,68 +36,11 @@ export default async function AuthedLayout({
 }: Props): Promise<ReactElement> {
   const { locale } = await params;
   const requestHeaders = await headers();
-  const session = await auth.api.getSession({ headers: requestHeaders });
-
-  if (!session) {
-    // No `x-pathname`, no locale read: a render outside the middleware keeps
-    // the operator gate without touching the locale config.
-    const pathname = requestHeaders.get("x-pathname");
-    const isAccount =
-      pathname !== null && isAccountPath(pathname, readLocales());
-    const t = await getTranslations({
-      locale,
-      namespace: isAccount ? "account.gate" : "waitlistDashboard.gate",
-    });
-    const active = getActiveProviderIds();
-    const emailLink = active.includes("magic-link")
-      ? { text: await resolveSignInCardText(locale) }
-      : undefined;
-    const providers = active.filter((id): id is AuthPanelProvider =>
-      (SUPPORTED_PROVIDERS as readonly string[]).includes(id),
-    );
-    const signInPath = localeHref(locale, "/sign-in");
-
-    if (isAccount && providers.length === 0 && !emailLink) {
-      return (
-        <div
-          className="flex min-h-screen flex-col items-center justify-center gap-4 py-section text-center"
-          data-testid="account-sign-in-gate"
-        >
-          <Heading level={1} visual={4}>
-            {t("emptyHeadline")}
-          </Heading>
-          <Text variant="body-sm" tone="muted" className="max-w-xs">
-            {t("emptyDescription")}
-          </Text>
-          {/* With no sign-in method on, /sign-in has nothing for a member
-              either, so the one action goes back to the site. Outline
-              action, 44px on a phone and 36px from md up. */}
-          <Button asChild variant="secondary" className="max-md:min-h-11">
-            <Link
-              href={localeHref(locale, "/")}
-              variant="bare"
-              data-testid="account-sign-in-gate-home"
-            >
-              {t("homeLink")}
-            </Link>
-          </Button>
-        </div>
-      );
-    }
+  const session = await readSession(requestHeaders);
 
-    return (
-      <SignInGate
-        labels={{
-          emptyHeadline: t("emptyHeadline"),
-          emptyDescription: t("emptyDescription"),
-          signInLinkLabel: t("signInLink"),
-        }}
-        signInPath={signInPath}
-        providers={providers}
-        {...(emailLink ? { emailLink } : {})}
-      />
-    );
-  }
+  // Awaited, not rendered as an element: the gate is a server function of the
+  // request, and the layout returns exactly the element it resolves to.
+  if (!session) return SignedOutGate({ locale, requestHeaders });
 
   // data-profile="app" puts the Pro-host editor surfaces in this group on
   // @working-theory/theme's app profile (#5953); tokens.css's own
@@ -131,7 +49,7 @@ export default async function AuthedLayout({
   // layout returns a fragment and the attribute needs an element.
   //
   // Two things about the placement are deliberate. Only the SIGNED-IN branch
-  // carries it: SignInGate above is the marketing site's sign-in front door,
+  // carries it: the gate above is the marketing site's sign-in front door,
   // not an app surface. And the attribute goes on this nested div rather than
   // the app's <html> because apps/web's marketing routes share that root and
   // must stay on the marketing profile — which also makes this half immune to