create-ailk 0.15.0 → 0.17.0

package/templates/apps/web/app/openapi.json/__tests__/route.test.ts

@@ -15,6 +15,13 @@
 
 import { GET } from "../route";
 
+// The REAL committed seam, for the #8060 hub-only guards: the mock below
+// shadows `TOPOLOGY` per case, but whether a hub-only case runs depends on the
+// render this scaffold carries, not on the topology a case picks.
+const { TOPOLOGY: SEAM_TOPOLOGY } = jest.requireActual<
+  typeof import("../../../lib/topology.generated")
+>("../../../lib/topology.generated");
+
 // The generated topology seam (#7426 D5), mocked so each case picks its
 // topology: the hub cases below run against `"hub"`, exactly as before; the
 // spoke cases (D12) flip it. Mocked rather than imported because the hub
@@ -93,16 +100,35 @@ describe("GET /openapi.json", () => {
     expect(requestedUrl()).toBe("http://api.internal:4000/v1/openapi.json");
   });
 
-  it("falls back to NEXT_PUBLIC_AILK_API_URL, then the local-dev API origin", async () => {
-    apiAnswers(200, JSON.stringify(SPEC));
-    await GET();
-    expect(requestedUrl()).toBe("http://localhost:3001/v1/openapi.json");
+  // #8060 — hub-only: a spoke render of the seam does not run this case.
+  (SEAM_TOPOLOGY === "hub" ? it : it.skip)(
+    "falls back to NEXT_PUBLIC_AILK_API_URL, then the local-dev API origin",
+    async () => {
+      apiAnswers(200, JSON.stringify(SPEC));
+      await GET();
+      expect(requestedUrl()).toBe("http://localhost:3001/v1/openapi.json");
+
+      fetchSpy.mockClear();
+      process.env["NEXT_PUBLIC_AILK_API_URL"] = "https://api.example.com/";
+      apiAnswers(200, JSON.stringify(SPEC));
+      await GET();
+      expect(requestedUrl()).toBe("https://api.example.com/v1/openapi.json");
+    },
+  );
 
-    fetchSpy.mockClear();
+  // #7874 D12 — the hub case above runs the committed (hub) render of the
+  // browser API origin seam unmocked; the spoke render reads no env at all.
+  it("skips the NEXT_PUBLIC_AILK_API_URL fallback under the seam's spoke render", async () => {
     process.env["NEXT_PUBLIC_AILK_API_URL"] = "https://api.example.com/";
     apiAnswers(200, JSON.stringify(SPEC));
-    await GET();
-    expect(requestedUrl()).toBe("https://api.example.com/v1/openapi.json");
+    await jest.isolateModulesAsync(async () => {
+      jest.doMock("../../../lib/api-origin.generated", () => ({
+        browserApiOrigin: (): string | undefined => undefined,
+      }));
+      const spoke = await import("../route");
+      await spoke.GET();
+    });
+    expect(requestedUrl()).toBe("http://localhost:3001/v1/openapi.json");
   });
 
   it("answers 502, not 404, when the API cannot be reached", async () => {
@@ -126,23 +152,30 @@ describe("GET /openapi.json", () => {
     expect(response.headers.get("cache-control")).toBe("no-store");
   });
 
-  it("resolves a relative servers[] URL against the public API origin", async () => {
-    process.env["AILK_API_URL"] = "http://api.internal:4000";
-    process.env["NEXT_PUBLIC_AILK_API_URL"] = "https://api.example.com/";
-    apiAnswers(
-      200,
-      JSON.stringify({ ...SPEC, servers: [{ url: "/", description: "x" }] }),
-    );
-
-    const body = (await (await GET()).json()) as typeof SPEC & {
-      servers: Array<{ url: string }>;
-    };
-
-    expect(requestedUrl()).toBe("http://api.internal:4000/v1/openapi.json");
-    expect(body.servers).toEqual([
-      { url: "https://api.example.com", description: "This deployment's API" },
-    ]);
-  });
+  // #8060 — hub-only: a spoke render of the seam does not run this case.
+  (SEAM_TOPOLOGY === "hub" ? it : it.skip)(
+    "resolves a relative servers[] URL against the public API origin",
+    async () => {
+      process.env["AILK_API_URL"] = "http://api.internal:4000";
+      process.env["NEXT_PUBLIC_AILK_API_URL"] = "https://api.example.com/";
+      apiAnswers(
+        200,
+        JSON.stringify({ ...SPEC, servers: [{ url: "/", description: "x" }] }),
+      );
+
+      const body = (await (await GET()).json()) as typeof SPEC & {
+        servers: Array<{ url: string }>;
+      };
+
+      expect(requestedUrl()).toBe("http://api.internal:4000/v1/openapi.json");
+      expect(body.servers).toEqual([
+        {
+          url: "https://api.example.com",
+          description: "This deployment's API",
+        },
+      ]);
+    },
+  );
 
   it("resolves a relative servers[] URL against AILK_API_URL when no public origin is set", async () => {
     process.env["AILK_API_URL"] = "http://localhost:3700";

package/templates/apps/web/app/openapi.json/route.ts

@@ -23,6 +23,7 @@
  * host, and never calls a path this site would answer 404.
  */
 
+import { browserApiOrigin } from "../../lib/api-origin.generated";
 import { RELAY_ROUTES } from "../../lib/relay";
 import { TOPOLOGY } from "../../lib/topology.generated";
 import { resolveBaseUrl } from "../../src/lib/routes";
@@ -43,9 +44,7 @@ const LOCAL_API_ORIGIN = "http://localhost:3001";
  */
 function apiBase(): string {
   return stripSlash(
-    process.env["AILK_API_URL"] ||
-      process.env["NEXT_PUBLIC_AILK_API_URL"] ||
-      LOCAL_API_ORIGIN,
+    process.env["AILK_API_URL"] || browserApiOrigin() || LOCAL_API_ORIGIN,
   );
 }
 
@@ -55,9 +54,7 @@ function apiBase(): string {
  */
 function publicApiBase(): string {
   return stripSlash(
-    process.env["NEXT_PUBLIC_AILK_API_URL"] ||
-      process.env["AILK_API_URL"] ||
-      LOCAL_API_ORIGIN,
+    browserApiOrigin() || process.env["AILK_API_URL"] || LOCAL_API_ORIGIN,
   );
 }
 

package/templates/apps/web/auth.ts

@@ -134,13 +134,16 @@ function deferredPrismaForAuth(): PrismaClient {
 }
 
 /**
- * The one delegate method `onPasswordReset` reaches for, named so the call
+ * The two delegate methods `onPasswordReset` reaches for, named so the call
  * site needs no cast. Method shorthand for the same reason `AuthEmailPrisma`
  * uses it: the generated `PrismaClient` satisfies this structurally, and
- * nothing wider than `verification.deleteMany` is reachable through it.
+ * nothing wider than `verification.deleteMany` and
+ * `oAuthAuthorization.updateMany` is reachable through it. The second ends
+ * every credential a spoke holds for the person (#7894 D4, SEC-7894-5).
  */
 interface VerificationStore {
   verification: { deleteMany(args: unknown): Promise<unknown> };
+  oAuthAuthorization: { updateMany(args: unknown): Promise<unknown> };
 }
 
 type SocialProviders = {
@@ -364,6 +367,30 @@ export function createAuth(deps: CreateAuthDeps = {}) {
         })}`,
       );
     }
+    /**
+     * A completed reset also ends every credential a SPOKE holds for this
+     * person (#7894 D4, SEC-7894-5). A hub session an attacker held minted
+     * spoke credentials of its own; recovering the account must end those too,
+     * or the attacker keeps reading the person's data on every spoke for the
+     * rest of the credential's 24 hours. The same posture as the sibling
+     * delete above: the reset ALREADY SUCCEEDED, so a failed revoke is
+     * logged (the user id and a reason, never a credential) and never turns
+     * it into a 500.
+     */
+    try {
+      await verificationStore.oAuthAuthorization.updateMany({
+        where: { userId: user.id, revokedAt: null },
+        data: { revokedAt: new Date() },
+      });
+    } catch {
+      console.warn(
+        `[auth-email] ${JSON.stringify({
+          userId: user.id,
+          kind: "password-reset",
+          reason: "spoke_credential_revocation_failed",
+        })}`,
+      );
+    }
     /**
      * Guarded like its sibling above, though `lib/auth-email.ts` now also
      * guards its own signing step (#6068). BOTH, deliberately: this callback

package/templates/apps/web/components/sign-out-trigger.tsx

@@ -3,6 +3,11 @@
 /**
  * SignOutTrigger — wraps the signed-in Nav's "Sign out" trigger (#4984).
  *
+ * With an `endpoint` (a spoke that signs in through its hub, #7894 D10) it
+ * POSTs there — the hub-session sign-out, which revokes the credential and
+ * clears the session cookie — and navigates home only when that succeeded;
+ * without one it calls Better Auth's client exactly as before.
+ *
  * The locale layout (RSC) reads the session and authors the "Sign out" nav
  * action as `kind: "flow"`; Nav hands the rendered trigger `<Button>` back
  * through `renderFlowTrigger` — composed in `SignedInNav`, on the client side
@@ -22,16 +27,30 @@ export interface SignOutTriggerProps {
   children: ReactNode;
   /** Where to land after signing out. Defaults to the site home. */
   homeHref?: string;
+  /** A same-origin sign-out route to POST to instead of Better Auth's client. */
+  endpoint?: string;
 }
 
 export function SignOutTrigger({
   children,
   homeHref = "/",
+  endpoint,
 }: SignOutTriggerProps): ReactElement {
   const router = useRouter();
 
   const handleSignOut = async (): Promise<void> => {
-    await authClient.signOut();
+    if (endpoint !== undefined) {
+      // A refused or failed sign-out leaves the visitor signed in, so the
+      // page must not pretend otherwise by navigating away.
+      try {
+        const res = await fetch(endpoint, { method: "POST", credentials: "same-origin" });
+        if (!res.ok) return;
+      } catch {
+        return;
+      }
+    } else {
+      await authClient.signOut();
+    }
     router.push(homeHref);
     router.refresh();
   };

package/templates/apps/web/components/signed-in-nav.tsx

@@ -32,9 +32,19 @@ import { SignOutTrigger } from "./sign-out-trigger";
 export type SignedInNavProps = Omit<
   NavProps,
   "navItems" | "renderFlowTrigger" | "translate" | "onSearchOpen"
->;
+> & {
+  /**
+   * Where "Sign out" POSTs, from the generated seam's `SIGN_OUT_ENDPOINT`
+   * (#7894 D10) — a spoke that signs in through its hub. Absent or `null`,
+   * Sign out goes through Better Auth's client, as on a hub.
+   */
+  signOutEndpoint?: string | null;
+};
 
-export function SignedInNav(props: SignedInNavProps): ReactElement {
+export function SignedInNav({
+  signOutEndpoint,
+  ...props
+}: SignedInNavProps): ReactElement {
   return (
     <Nav
       {...props}
@@ -43,7 +53,11 @@ export function SignedInNav(props: SignedInNavProps): ReactElement {
       // SignOutTrigger, the account action a non-navigating name label.
       renderFlowTrigger={(action, trigger) =>
         action.labelKey === "signOut" ? (
-          <SignOutTrigger>{trigger}</SignOutTrigger>
+          <SignOutTrigger
+            {...(signOutEndpoint ? { endpoint: signOutEndpoint } : {})}
+          >
+            {trigger}
+          </SignOutTrigger>
         ) : (
           <span
             className="text-body-sm text-(--color-text-muted)"

package/templates/apps/web/lib/__tests__/account-config.test.ts

@@ -107,10 +107,12 @@ describe("account-config exports (AC-6)", () => {
     expect(Array.isArray(accountForYouSources)).toBe(true);
   });
 
-  it("ships exactly the two base Inbox kinds, both Recents rows (D6a, D9)", () => {
+  it("ships exactly the base Inbox kinds and the member kinds (#7920), all Recents rows (D6a, D9)", () => {
     expect(accountInboxKinds.map((k) => [k.kind, k.section])).toEqual([
       ["result", "updates"],
       ["purchase", "updates"],
+      ["piece", "updates"],
+      ["message", "updates"],
     ]);
     // Nothing in the base area fills Scheduled (the old Upcoming), and no
     // Inbox row asks for a decision — that is the For-you panel's job.
@@ -118,10 +120,11 @@ describe("account-config exports (AC-6)", () => {
     expect(accountInboxKinds.some((k) => k.section === "needs-you")).toBe(false);
   });
 
-  it("ships email-unverified and payment-due as For-you sources, not Inbox kinds (D9 as amended)", () => {
+  it("ships email-unverified, payment-due and piece-needs-client (#7920) as For-you sources, not Inbox kinds (D9 as amended)", () => {
     expect(accountForYouSources.map((s) => s.id)).toEqual([
       "email-unverified",
       "payment-due",
+      "piece-needs-client",
     ]);
     const kinds = accountInboxKinds.map((k) => k.kind);
     expect(kinds).not.toContain("email-unverified");

package/templates/apps/web/lib/__tests__/listings-config.test.ts

@@ -0,0 +1,83 @@
+/**
+ * The one reader of the listing site key (#7872 D8, AC-6).
+ *
+ * `NEXT_PUBLIC_AILK_LISTING_SITE_KEY` wins; `AILK_LISTING_PUBLIC_KEY` is the
+ * fallback every site configured since create-ailk 0.12.0 already sets; an
+ * empty or whitespace value counts as unset, so the listicle directory stays
+ * off rather than reading the hub with a blank key.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { listingSiteKey, listingsEnabled } from "../listings-config";
+
+const PUBLIC_NAME = "NEXT_PUBLIC_AILK_LISTING_SITE_KEY";
+const FALLBACK_NAME = "AILK_LISTING_PUBLIC_KEY";
+
+const original = {
+  public: process.env[PUBLIC_NAME],
+  fallback: process.env[FALLBACK_NAME],
+};
+
+function setEnv(name: string, value: string | undefined): void {
+  if (value === undefined) delete process.env[name];
+  else process.env[name] = value;
+}
+
+afterEach(() => {
+  setEnv(PUBLIC_NAME, original.public);
+  setEnv(FALLBACK_NAME, original.fallback);
+});
+
+describe("listingSiteKey / listingsEnabled", () => {
+  it("answers the trimmed public name when both are set", () => {
+    setEnv(PUBLIC_NAME, "  site-public  ");
+    setEnv(FALLBACK_NAME, "site-fallback");
+
+    expect(listingSiteKey()).toBe("site-public");
+    expect(listingsEnabled()).toBe(true);
+  });
+
+  it("answers the trimmed fallback when only it is set", () => {
+    setEnv(PUBLIC_NAME, undefined);
+    setEnv(FALLBACK_NAME, " site-fallback\n");
+
+    expect(listingSiteKey()).toBe("site-fallback");
+    expect(listingsEnabled()).toBe(true);
+  });
+
+  it("falls back when the public name is whitespace only", () => {
+    setEnv(PUBLIC_NAME, "   ");
+    setEnv(FALLBACK_NAME, "site-fallback");
+
+    expect(listingSiteKey()).toBe("site-fallback");
+    expect(listingsEnabled()).toBe(true);
+  });
+
+  it("answers undefined when neither is set", () => {
+    setEnv(PUBLIC_NAME, undefined);
+    setEnv(FALLBACK_NAME, undefined);
+
+    expect(listingSiteKey()).toBeUndefined();
+    expect(listingsEnabled()).toBe(false);
+  });
+
+  it("answers undefined when both are empty or whitespace", () => {
+    setEnv(PUBLIC_NAME, "");
+    setEnv(FALLBACK_NAME, "  \t");
+
+    expect(listingSiteKey()).toBeUndefined();
+    expect(listingsEnabled()).toBe(false);
+  });
+});
+
+describe("apps/web/.env.example", () => {
+  it("documents both names", () => {
+    const example = readFileSync(
+      join(__dirname, "..", "..", ".env.example"),
+      "utf8",
+    );
+    expect(example).toMatch(new RegExp(`^# ${PUBLIC_NAME}=`, "m"));
+    expect(example).toMatch(new RegExp(`^# ${FALLBACK_NAME}=`, "m"));
+  });
+});

package/templates/apps/web/lib/__tests__/listings.test.tsx

@@ -294,6 +294,55 @@ describe("no read without a key or the paid package", () => {
   });
 });
 
+describe("the default key reader is listings-config's (#7872 D8)", () => {
+  const PUBLIC_NAME = "NEXT_PUBLIC_AILK_LISTING_SITE_KEY";
+  const FALLBACK_NAME = "AILK_LISTING_PUBLIC_KEY";
+  const original = { public: process.env[PUBLIC_NAME], fallback: process.env[FALLBACK_NAME] };
+
+  function setEnv(name: string, value: string | undefined): void {
+    if (value === undefined) delete process.env[name];
+    else process.env[name] = value;
+  }
+
+  /** Every dependency but the key: the extension falls back to its own reader. */
+  function keylessDepsExtension() {
+    return createListingExtension({
+      pathname: async () => path,
+      locales: () => ["en", "fr"],
+      fetchDirectory,
+      loadUi: async () => STUB_UI,
+      translate: async () => (key: string) => `listings.${key}`,
+      baseUrl: () => "https://site.test",
+    });
+  }
+
+  afterEach(() => {
+    setEnv(PUBLIC_NAME, original.public);
+    setEnv(FALLBACK_NAME, original.fallback);
+  });
+
+  it("reads the directory with NEXT_PUBLIC_AILK_LISTING_SITE_KEY", async () => {
+    setEnv(PUBLIC_NAME, "k");
+    setEnv(FALLBACK_NAME, undefined);
+    path = "/en/partners";
+
+    await keylessDepsExtension().appendix!({ type: "AboutPage", slug: "partners", locale: "en" });
+
+    expect(fetchDirectory).toHaveBeenCalledWith("k", "/partners", "en");
+  });
+
+  it("makes no read with neither variable set", async () => {
+    setEnv(PUBLIC_NAME, undefined);
+    setEnv(FALLBACK_NAME, undefined);
+    path = "/en/partners";
+
+    expect(
+      await keylessDepsExtension().appendix!({ type: "AboutPage", slug: "partners", locale: "en" }),
+    ).toBeNull();
+    expect(fetchDirectory).toHaveBeenCalledTimes(0);
+  });
+});
+
 describe("a failed read renders the page as today", () => {
   let warn: jest.SpyInstance;
   beforeEach(() => {

package/templates/apps/web/lib/__tests__/meeting-slugs.test.ts

@@ -1,7 +1,11 @@
 // oss: false
 /**
  * Tests for enabledMeetingSlugs (#6183 S9b D5) — the D4-resolving read both
- * /meet pages share.
+ * /meet pages share — and its spoke branch (#7872 D4).
+ *
+ * The topology seam is mocked: its hub render imports `../auth`, which this
+ * suite has no reason to load (`app/openapi.json/__tests__/route.test.ts`'s
+ * pattern).
  */
 const mockMeetingTypes = jest.fn();
 jest.mock("@working-theory/api-client", () => ({
@@ -9,6 +13,14 @@ jest.mock("@working-theory/api-client", () => ({
   schedule: { meetingTypes: (...args: unknown[]) => mockMeetingTypes(...args) },
 }));
 
+const mockTopology: { value: "hub" | "spoke" } = { value: "hub" };
+// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426 D5), not a runtime input; the seam IS the boundary between a hub and a spoke build, and there is no env or HTTP surface that selects it.
+jest.mock("../topology.generated", () => ({
+  get TOPOLOGY() {
+    return mockTopology.value;
+  },
+}));
+
 import { enabledMeetingSlugs } from "../meeting-slugs";
 
 describe("enabledMeetingSlugs", () => {
@@ -16,6 +28,7 @@ describe("enabledMeetingSlugs", () => {
 
   beforeEach(() => {
     mockMeetingTypes.mockReset();
+    mockTopology.value = "hub";
   });
 
   afterEach(() => {
@@ -70,3 +83,38 @@ describe("enabledMeetingSlugs", () => {
     await expect(enabledMeetingSlugs()).resolves.toEqual([]);
   });
 });
+
+describe("enabledMeetingSlugs on a spoke (#7872 D4)", () => {
+  const originalEnv = process.env["SCHEDULING_CAL_LINK"];
+
+  beforeEach(() => {
+    mockMeetingTypes.mockReset();
+    mockTopology.value = "spoke";
+  });
+
+  afterEach(() => {
+    mockTopology.value = "hub";
+    if (originalEnv === undefined) delete process.env["SCHEDULING_CAL_LINK"];
+    else process.env["SCHEDULING_CAL_LINK"] = originalEnv;
+  });
+
+  it("null + SCHEDULING_CAL_LINK set → [], never the fallback: the hub books only a stored slug", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+
+  it("passes the workspace's stored list through unchanged", async () => {
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: ["intro"] } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual(["intro"]);
+  });
+
+  it("a non-ok API result → [], fail closed", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: false, status: 401, body: null });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+});

package/templates/apps/web/lib/__tests__/relay.test.ts

@@ -12,6 +12,7 @@
 
 import { handleRelay, RELAY_ROUTES } from "../relay";
 import { __resetRelayRateLimit, __relayRateLimitBucketCount } from "../relay";
+import { TOPOLOGY } from "../topology.generated";
 
 const HUB = "https://hub.example";
 const SITE = "https://spoke.example";
@@ -513,6 +514,38 @@ describe("hardening — what the site serves, and a missing hub address", () =>
       expect(res.status).toBe(201);
       expect(fetchMock).toHaveBeenCalledTimes(1);
     });
+
+    // #7874 D12 — the fallback reads the browser API origin seam. The
+    // committed seam is the hub render, so this case runs it unmocked.
+    // #8060 — hub-only: a spoke render of the seam reads no
+    // NEXT_PUBLIC_AILK_API_URL, so a spoke scaffold skips this case.
+    (TOPOLOGY === "hub" ? it : it.skip)(
+      "on a hub, NEXT_PUBLIC_AILK_API_URL alone still counts as a hub address",
+      async () => {
+        delete process.env.AILK_API_URL;
+        process.env.NEXT_PUBLIC_AILK_API_URL = HUB;
+        const res = await handleRelay(relayRequest("/v1/leads/submit"));
+        expect(res.status).toBe(201);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+      },
+    );
+
+    it("on a spoke (the seam's spoke render), that fallback is skipped", async () => {
+      delete process.env.AILK_API_URL;
+      process.env.NEXT_PUBLIC_AILK_API_URL = HUB;
+      let res: Response | undefined;
+      await jest.isolateModulesAsync(async () => {
+        jest.doMock("../api-origin.generated", () => ({
+          browserApiOrigin: (): string | undefined => undefined,
+        }));
+        const spoke = await import("../relay");
+        res = await spoke.handleRelay(relayRequest("/v1/leads/submit"));
+      });
+      if (res === undefined) throw new Error("the spoke relay did not answer");
+      expect(res.status).toBe(502);
+      expect(await errorCode(res)).toBe("relay_unreachable");
+      expect(fetchMock).not.toHaveBeenCalled();
+    });
   });
 });
 

package/templates/apps/web/lib/__tests__/server-api.test.ts

@@ -11,6 +11,7 @@
  * sets `Origin`.
  */
 import { forwardedCookieInit } from "../server-api";
+import { TOPOLOGY } from "../topology.generated";
 
 const mockCookies = jest.fn();
 const mockHeaders = jest.fn();
@@ -27,35 +28,43 @@ describe("forwardedCookieInit", () => {
     mockHeaders.mockReset();
   });
 
-  it("forwards cookie + origin when the incoming request carries an Origin header", async () => {
-    mockCookies.mockResolvedValue({
-      toString: () => "better-auth.session_token=abc",
-    });
-    mockHeaders.mockResolvedValue(
-      new Headers({ origin: "https://app.example.com" }),
-    );
-
-    const init = await forwardedCookieInit();
-
-    expect(init).toEqual({
-      headers: {
-        cookie: "better-auth.session_token=abc",
-        origin: "https://app.example.com",
-      },
-    });
-  });
+  // #8060 — hub-only: a spoke render of the seam does not run this case.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "forwards cookie + origin when the incoming request carries an Origin header",
+    async () => {
+      mockCookies.mockResolvedValue({
+        toString: () => "better-auth.session_token=abc",
+      });
+      mockHeaders.mockResolvedValue(
+        new Headers({ origin: "https://app.example.com" }),
+      );
 
-  it("forwards cookie alone — no origin key at all — when Origin is absent", async () => {
-    mockCookies.mockResolvedValue({
-      toString: () => "better-auth.session_token=abc",
-    });
-    mockHeaders.mockResolvedValue(new Headers());
+      const init = await forwardedCookieInit();
 
-    const init = await forwardedCookieInit();
+      expect(init).toEqual({
+        headers: {
+          cookie: "better-auth.session_token=abc",
+          origin: "https://app.example.com",
+        },
+      });
+    },
+  );
 
-    expect(init).toEqual({
-      headers: { cookie: "better-auth.session_token=abc" },
-    });
-    expect(init.headers).not.toHaveProperty("origin");
-  });
+  // #8060 — hub-only: a spoke render of the seam does not run this case.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "forwards cookie alone — no origin key at all — when Origin is absent",
+    async () => {
+      mockCookies.mockResolvedValue({
+        toString: () => "better-auth.session_token=abc",
+      });
+      mockHeaders.mockResolvedValue(new Headers());
+
+      const init = await forwardedCookieInit();
+
+      expect(init).toEqual({
+        headers: { cookie: "better-auth.session_token=abc" },
+      });
+      expect(init.headers).not.toHaveProperty("origin");
+    },
+  );
 });