create-ailk 0.16.0 → 0.17.0

package/dist/spoke-checkout.d.ts

@@ -24,15 +24,40 @@ export declare function spokeEnvRowOptions(commerce: boolean): Pick<PlanEnvRowsO
  * `site-` and the first 8 hex characters of its SHA-256. Never `AILK_SITE_ID`.
  */
 export declare function spokeCheckoutSite(projectName: string): string;
+/** Where a commerce spoke's end-to-end checkout workflow lives. */
+export declare const SPOKE_CHECKOUT_E2E_WORKFLOW_PATH = ".github/workflows/checkout-e2e.yml";
+/**
+ * The Stripe CLI release the workflow installs, and the SHA-256 of its
+ * `stripe_<v>_linux_x86_64.tar.gz` from that release's own
+ * `stripe-linux-checksums.txt`. Never bump one without re-reading the other.
+ */
+export declare const STRIPE_CLI_VERSION = "1.51.1";
+export declare const STRIPE_CLI_LINUX_X64_SHA256 = "38c8de73a8cab810a4aab8a4015cd4e3398b7b87aa42b6944d09d89ed524ac53";
+/** The Playwright the workflow installs — the monorepo's own pinned version. */
+export declare const E2E_PLAYWRIGHT_VERSION = "1.61.1";
+/**
+ * Every action the workflow uses, pinned to the commit its `v4` tag named
+ * when this was written (SEC-7839-2): `gh api repos/<action>/commits/v4`.
+ */
+export declare const E2E_ACTION_PINS: Readonly<Record<string, string>>;
+/**
+ * The workflow text (D8). Identical for every spoke at one create-ailk
+ * version. Every `${{ … }}` sits in an env-style value, never in a script.
+ */
+export declare const CHECKOUT_E2E_WORKFLOW: string;
 /**
  * The slice for `site`, in order: the two route files, the config, the two
- * pages (D3). Throws `TopologyError` for an invalid stamp (SEC-7838-10).
+ * pages (D3), then the checkout e2e workflow (#7839 D8), which does not
+ * depend on `site`. Throws `TopologyError` for an invalid stamp (SEC-7838-10).
  */
 export declare function renderSpokeCheckoutFiles(site: string): [string, string][];
 /**
  * Write the slice into `targetDir` (D3). A file that already exists is left
  * byte-for-byte and reported `skipped` — the config is the site's once
- * written. Adds the package to `apps/web/package.json` only when absent.
+ * written. Adds the package to `apps/web/package.json` when absent, and
+ * raises a plain pin older than the one it writes (#7839): the generated
+ * checkout e2e workflow runs a command a `^0.2.0` pin never reaches. Any
+ * other range — newer, `workspace:`, a tag — is the site's and is kept.
  * Every refusal (an invalid stamp, a version map without the package, a
  * missing or malformed `apps/web/package.json`) throws before the first write.
  */

package/dist/spoke-checkout.js

@@ -286,9 +286,183 @@ const UNAVAILABLE_PAGE = renderPage({
         "},",
     ],
 });
+// ── #7839 D8 — the checkout e2e workflow ─────────────────────────────────────
+/** Where a commerce spoke's end-to-end checkout workflow lives. */
+export const SPOKE_CHECKOUT_E2E_WORKFLOW_PATH = ".github/workflows/checkout-e2e.yml";
+/**
+ * The Stripe CLI release the workflow installs, and the SHA-256 of its
+ * `stripe_<v>_linux_x86_64.tar.gz` from that release's own
+ * `stripe-linux-checksums.txt`. Never bump one without re-reading the other.
+ */
+export const STRIPE_CLI_VERSION = "1.51.1";
+export const STRIPE_CLI_LINUX_X64_SHA256 = "38c8de73a8cab810a4aab8a4015cd4e3398b7b87aa42b6944d09d89ed524ac53";
+/** The Playwright the workflow installs — the monorepo's own pinned version. */
+export const E2E_PLAYWRIGHT_VERSION = "1.61.1";
+/**
+ * Every action the workflow uses, pinned to the commit its `v4` tag named
+ * when this was written (SEC-7839-2): `gh api repos/<action>/commits/v4`.
+ */
+export const E2E_ACTION_PINS = Object.freeze({
+    "actions/checkout": "11d5960a326750d5838078e36cf38b85af677262",
+    "pnpm/action-setup": "b906affcce14559ad1aafd4ab0e942779e9f58b1",
+    "actions/setup-node": "49933ea5288caeca8642d1e84afbd3f7d6820020",
+    "actions/upload-artifact": "ea165f8d65b6e75b540449e92b4886f43607fa02",
+});
+function uses(action) {
+    return `uses: ${action}@${E2E_ACTION_PINS[action]} # v4`;
+}
+/**
+ * The workflow text (D8). Identical for every spoke at one create-ailk
+ * version. Every `${{ … }}` sits in an env-style value, never in a script.
+ */
+export const CHECKOUT_E2E_WORKFLOW = `# Checkout e2e — GENERATED by create-ailk (#7839). Do not edit: it changes
+# with the ${SPOKE_CHECKOUT_PACKAGE} command it runs.
+#
+# Pays each named offering once through Stripe's hosted Checkout in TEST
+# mode, then checks Stripe's webhook was answered 2xx and this site's
+# fulfilment ran. Start it by hand (Actions > Checkout e2e > Run workflow)
+# after a checkout change and before any live flip. It never runs on a push
+# or a pull request: it needs the network, the Stripe CLI and test-mode state.
+#
+# Setup, once: create the GitHub Environment "checkout-e2e", limit its
+# deployment branches to the default branch, and add to it the secrets
+# STRIPE_TEST_SECRET_KEY (an sk_test_ or rk_test_ key) and AILK_SPOKE_KEY,
+# and the variable AILK_API_URL (https). Each paid session posts one
+# test-mode lead to the hub. Test subscriptions it creates are cancelled.
+name: Checkout e2e
+
+on:
+  workflow_dispatch:
+    inputs:
+      offerings:
+        description: Comma-separated fixed offering slugs from apps/web/lib/checkout-config.ts
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: checkout-e2e
+  cancel-in-progress: false
+
+jobs:
+  checkout-e2e:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: checkout-e2e
+    env:
+      NEXT_PUBLIC_BASE_URL: http://localhost:3000
+      STRIPE_MODE: test
+    steps:
+      - name: Refuse a live key or a missing setting
+        env:
+          STRIPE_SECRET_KEY: \${{ secrets.STRIPE_TEST_SECRET_KEY }}
+          AILK_SPOKE_KEY: \${{ secrets.AILK_SPOKE_KEY }}
+          AILK_API_URL: \${{ vars.AILK_API_URL }}
+        run: |
+          case "$STRIPE_SECRET_KEY" in
+            sk_test_*|rk_test_*) ;;
+            *) echo "::error::STRIPE_TEST_SECRET_KEY must be an sk_test_ or rk_test_ key"; exit 2 ;;
+          esac
+          if [ -z "$AILK_SPOKE_KEY" ]; then
+            echo "::error::set the AILK_SPOKE_KEY secret in the checkout-e2e environment"; exit 2
+          fi
+          case "$AILK_API_URL" in
+            https://*) ;;
+            *) echo "::error::AILK_API_URL must be the hub's https origin"; exit 2 ;;
+          esac
+
+      - ${uses("actions/checkout")}
+
+      - ${uses("pnpm/action-setup")}
+
+      - run: test -f pnpm-lock.yaml || touch pnpm-lock.yaml
+
+      - ${uses("actions/setup-node")}
+        with:
+          node-version: 20
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install
+        run: |
+          if [ -s pnpm-lock.yaml ]; then pnpm install --frozen-lockfile; else pnpm install; fi
+
+      - name: Install the Stripe CLI (pinned, checksum-checked)
+        run: |
+          curl -fsSL -o "$RUNNER_TEMP/stripe.tar.gz" \\
+            https://github.com/stripe/stripe-cli/releases/download/v${STRIPE_CLI_VERSION}/stripe_${STRIPE_CLI_VERSION}_linux_x86_64.tar.gz
+          echo "${STRIPE_CLI_LINUX_X64_SHA256}  $RUNNER_TEMP/stripe.tar.gz" | sha256sum -c -
+          mkdir -p "$RUNNER_TEMP/stripe-cli"
+          tar -xzf "$RUNNER_TEMP/stripe.tar.gz" -C "$RUNNER_TEMP/stripe-cli" stripe
+
+      - name: Install Playwright (pinned) and Chromium
+        run: |
+          npm install --no-save --ignore-scripts --prefix "$RUNNER_TEMP/e2e-deps" playwright@${E2E_PLAYWRIGHT_VERSION}
+          "$RUNNER_TEMP/e2e-deps/node_modules/.bin/playwright" install --with-deps chromium
+
+      - name: Fetch the Stripe CLI's signing secret
+        env:
+          STRIPE_API_KEY: \${{ secrets.STRIPE_TEST_SECRET_KEY }}
+        run: |
+          umask 077
+          secret="$("$RUNNER_TEMP/stripe-cli/stripe" listen --print-secret)"
+          echo "::add-mask::$secret"
+          printf '%s' "$secret" > "$RUNNER_TEMP/stripe-whsec"
+
+      - name: Build the site
+        run: pnpm --filter ./apps/web build
+
+      - name: Start the site
+        env:
+          STRIPE_SECRET_KEY: \${{ secrets.STRIPE_TEST_SECRET_KEY }}
+          AILK_SPOKE_KEY: \${{ secrets.AILK_SPOKE_KEY }}
+          AILK_API_URL: \${{ vars.AILK_API_URL }}
+        run: |
+          STRIPE_WEBHOOK_SECRET="$(cat "$RUNNER_TEMP/stripe-whsec")"
+          export STRIPE_WEBHOOK_SECRET
+          cd apps/web
+          nohup pnpm exec next start -p 3000 -H localhost > "$RUNNER_TEMP/next.log" 2>&1 &
+          echo $! > "$RUNNER_TEMP/next.pid"
+          for _ in $(seq 1 60); do
+            curl -fsS -o /dev/null http://localhost:3000/checkout/thank-you && exit 0
+            sleep 2
+          done
+          echo "::error::the site did not start on localhost:3000; run it locally with the same settings to see why"
+          exit 1
+
+      - name: Pay each offering
+        working-directory: apps/web
+        env:
+          STRIPE_SECRET_KEY: \${{ secrets.STRIPE_TEST_SECRET_KEY }}
+          OFFERINGS: \${{ inputs.offerings }}
+          SPOKE_CHECKOUT_E2E_DEPS: \${{ runner.temp }}/e2e-deps
+          STRIPE_CLI_PATH: \${{ runner.temp }}/stripe-cli/stripe
+        run: |
+          STRIPE_WEBHOOK_SECRET="$(cat "$RUNNER_TEMP/stripe-whsec")"
+          export STRIPE_WEBHOOK_SECRET
+          pnpm exec spoke-checkout-e2e --base-url http://localhost:3000 --offerings "$OFFERINGS" --out "$RUNNER_TEMP/checkout-e2e"
+
+      - name: Stop the site
+        if: always()
+        run: |
+          if [ -f "$RUNNER_TEMP/next.pid" ]; then pkill -P "$(cat "$RUNNER_TEMP/next.pid")" || true; kill "$(cat "$RUNNER_TEMP/next.pid")" || true; fi
+          rm -f "$RUNNER_TEMP/stripe-whsec"
+
+      - name: Keep the report
+        if: always()
+        ${uses("actions/upload-artifact")}
+        with:
+          name: checkout-e2e
+          path: \${{ runner.temp }}/checkout-e2e
+          if-no-files-found: ignore
+          retention-days: 7
+`;
 /**
  * The slice for `site`, in order: the two route files, the config, the two
- * pages (D3). Throws `TopologyError` for an invalid stamp (SEC-7838-10).
+ * pages (D3), then the checkout e2e workflow (#7839 D8), which does not
+ * depend on `site`. Throws `TopologyError` for an invalid stamp (SEC-7838-10).
  */
 export function renderSpokeCheckoutFiles(site) {
     assertSite(site);
@@ -300,6 +474,7 @@ export function renderSpokeCheckoutFiles(site) {
         [SPOKE_CHECKOUT_CONFIG_PATH, renderConfig(site)],
         [thankYouPath, THANK_YOU_PAGE],
         [unavailablePath, UNAVAILABLE_PAGE],
+        [SPOKE_CHECKOUT_E2E_WORKFLOW_PATH, CHECKOUT_E2E_WORKFLOW],
     ];
 }
 const WEB_PACKAGE_JSON = "apps/web/package.json";
@@ -319,10 +494,32 @@ function withDependency(deps, name, version) {
         out[name] = version;
     return out;
 }
+/** A plain `x.y.z`, `^x.y.z` or `~x.y.z` pin's version; null for any other range. */
+function pinnedVersion(range) {
+    const match = /^[\^~]?(\d+)\.(\d+)\.(\d+)$/.exec(range.trim());
+    return match === null
+        ? null
+        : [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+/** True when `current` pins a version strictly older than `wanted` does. */
+function isOlderPin(current, wanted) {
+    const a = pinnedVersion(current);
+    const b = pinnedVersion(wanted);
+    if (a === null || b === null)
+        return false;
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] < b[i];
+    }
+    return false;
+}
 /**
  * Write the slice into `targetDir` (D3). A file that already exists is left
  * byte-for-byte and reported `skipped` — the config is the site's once
- * written. Adds the package to `apps/web/package.json` only when absent.
+ * written. Adds the package to `apps/web/package.json` when absent, and
+ * raises a plain pin older than the one it writes (#7839): the generated
+ * checkout e2e workflow runs a command a `^0.2.0` pin never reaches. Any
+ * other range — newer, `workspace:`, a tag — is the site's and is kept.
  * Every refusal (an invalid stamp, a version map without the package, a
  * missing or malformed `apps/web/package.json`) throws before the first write.
  */
@@ -345,8 +542,14 @@ export function writeSpokeCheckoutSlice(targetDir, opts) {
         rows.push({ path, action: "written" });
     }
     const deps = pkg.dependencies ?? {};
-    if (!Object.prototype.hasOwnProperty.call(deps, SPOKE_CHECKOUT_PACKAGE)) {
-        pkg.dependencies = withDependency(deps, SPOKE_CHECKOUT_PACKAGE, version);
+    const current = Object.prototype.hasOwnProperty.call(deps, SPOKE_CHECKOUT_PACKAGE)
+        ? deps[SPOKE_CHECKOUT_PACKAGE]
+        : undefined;
+    if (current === undefined || isOlderPin(current, version)) {
+        pkg.dependencies =
+            current === undefined
+                ? withDependency(deps, SPOKE_CHECKOUT_PACKAGE, version)
+                : { ...deps, [SPOKE_CHECKOUT_PACKAGE]: version };
         const after = `${JSON.stringify(pkg, null, 2)}${before.endsWith("\n") ? "\n" : ""}`;
         writeFileSync(pkgPath, after);
         rows.push({

package/dist/topology.js

@@ -782,8 +782,9 @@ export function renderSpokeHardFloors(opts) {
         "  # Surfaces that always require human review on merge, regardless of",
         "  # automation level. This site is a SPOKE (create-ailk --topology spoke):",
         "  # it has no apps/api, no database and no sign-in of its own. Pricing, the",
-        "  # Stripe webhook route, the checkout route and its price map, and the",
-        "  # sign-in paths are floored so their arrival here is a human merge.",
+        "  # Stripe webhook route, the checkout route, its price map and its e2e",
+        "  # workflow, and the sign-in paths are floored so their arrival here is a",
+        "  # human merge.",
         "  - kind: pricing",
         "  - kind: stripe_live_mode",
         "  - paths:",
@@ -792,7 +793,8 @@ export function renderSpokeHardFloors(opts) {
         "  - paths:",
         '      - "apps/web/app/api/checkout/**"',
         '      - "apps/web/lib/checkout-config.ts"',
-        "    reason: Spoke checkout — the buy route and the price map require human review",
+        '      - ".github/workflows/checkout-e2e.yml"',
+        "    reason: Spoke checkout — the buy route, the price map and the checkout e2e workflow require human review",
         "  - paths:",
         '      - "apps/web/auth.ts"',
         '      - "apps/web/app/api/auth/**"',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ailk",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Scaffolder for AI Launch Kit — `pnpm create ailk@latest <dir>` produces a starter repo consuming @working-theory/* from npm (per ADR 0007).",
   "type": "module",
   "main": "./dist/index.js",
@@ -27,8 +27,8 @@
     "tar": "^7.5.21"
   },
   "devDependencies": {
-    "@working-theory/schema": "0.38.0",
-    "@working-theory/templates": "0.38.0"
+    "@working-theory/templates": "0.38.0",
+    "@working-theory/schema": "0.38.0"
   },
   "repository": {
     "type": "git",

package/templates/apps/web/app/openapi.json/__tests__/route.test.ts

@@ -15,6 +15,13 @@
 
 import { GET } from "../route";
 
+// The REAL committed seam, for the #8060 hub-only guards: the mock below
+// shadows `TOPOLOGY` per case, but whether a hub-only case runs depends on the
+// render this scaffold carries, not on the topology a case picks.
+const { TOPOLOGY: SEAM_TOPOLOGY } = jest.requireActual<
+  typeof import("../../../lib/topology.generated")
+>("../../../lib/topology.generated");
+
 // The generated topology seam (#7426 D5), mocked so each case picks its
 // topology: the hub cases below run against `"hub"`, exactly as before; the
 // spoke cases (D12) flip it. Mocked rather than imported because the hub
@@ -93,17 +100,21 @@ describe("GET /openapi.json", () => {
     expect(requestedUrl()).toBe("http://api.internal:4000/v1/openapi.json");
   });
 
-  it("falls back to NEXT_PUBLIC_AILK_API_URL, then the local-dev API origin", async () => {
-    apiAnswers(200, JSON.stringify(SPEC));
-    await GET();
-    expect(requestedUrl()).toBe("http://localhost:3001/v1/openapi.json");
-
-    fetchSpy.mockClear();
-    process.env["NEXT_PUBLIC_AILK_API_URL"] = "https://api.example.com/";
-    apiAnswers(200, JSON.stringify(SPEC));
-    await GET();
-    expect(requestedUrl()).toBe("https://api.example.com/v1/openapi.json");
-  });
+  // #8060 — hub-only: a spoke render of the seam does not run this case.
+  (SEAM_TOPOLOGY === "hub" ? it : it.skip)(
+    "falls back to NEXT_PUBLIC_AILK_API_URL, then the local-dev API origin",
+    async () => {
+      apiAnswers(200, JSON.stringify(SPEC));
+      await GET();
+      expect(requestedUrl()).toBe("http://localhost:3001/v1/openapi.json");
+
+      fetchSpy.mockClear();
+      process.env["NEXT_PUBLIC_AILK_API_URL"] = "https://api.example.com/";
+      apiAnswers(200, JSON.stringify(SPEC));
+      await GET();
+      expect(requestedUrl()).toBe("https://api.example.com/v1/openapi.json");
+    },
+  );
 
   // #7874 D12 — the hub case above runs the committed (hub) render of the
   // browser API origin seam unmocked; the spoke render reads no env at all.
@@ -141,23 +152,30 @@ describe("GET /openapi.json", () => {
     expect(response.headers.get("cache-control")).toBe("no-store");
   });
 
-  it("resolves a relative servers[] URL against the public API origin", async () => {
-    process.env["AILK_API_URL"] = "http://api.internal:4000";
-    process.env["NEXT_PUBLIC_AILK_API_URL"] = "https://api.example.com/";
-    apiAnswers(
-      200,
-      JSON.stringify({ ...SPEC, servers: [{ url: "/", description: "x" }] }),
-    );
-
-    const body = (await (await GET()).json()) as typeof SPEC & {
-      servers: Array<{ url: string }>;
-    };
-
-    expect(requestedUrl()).toBe("http://api.internal:4000/v1/openapi.json");
-    expect(body.servers).toEqual([
-      { url: "https://api.example.com", description: "This deployment's API" },
-    ]);
-  });
+  // #8060 — hub-only: a spoke render of the seam does not run this case.
+  (SEAM_TOPOLOGY === "hub" ? it : it.skip)(
+    "resolves a relative servers[] URL against the public API origin",
+    async () => {
+      process.env["AILK_API_URL"] = "http://api.internal:4000";
+      process.env["NEXT_PUBLIC_AILK_API_URL"] = "https://api.example.com/";
+      apiAnswers(
+        200,
+        JSON.stringify({ ...SPEC, servers: [{ url: "/", description: "x" }] }),
+      );
+
+      const body = (await (await GET()).json()) as typeof SPEC & {
+        servers: Array<{ url: string }>;
+      };
+
+      expect(requestedUrl()).toBe("http://api.internal:4000/v1/openapi.json");
+      expect(body.servers).toEqual([
+        {
+          url: "https://api.example.com",
+          description: "This deployment's API",
+        },
+      ]);
+    },
+  );
 
   it("resolves a relative servers[] URL against AILK_API_URL when no public origin is set", async () => {
     process.env["AILK_API_URL"] = "http://localhost:3700";

package/templates/apps/web/lib/__tests__/relay.test.ts

@@ -12,6 +12,7 @@
 
 import { handleRelay, RELAY_ROUTES } from "../relay";
 import { __resetRelayRateLimit, __relayRateLimitBucketCount } from "../relay";
+import { TOPOLOGY } from "../topology.generated";
 
 const HUB = "https://hub.example";
 const SITE = "https://spoke.example";
@@ -516,13 +517,18 @@ describe("hardening — what the site serves, and a missing hub address", () =>
 
     // #7874 D12 — the fallback reads the browser API origin seam. The
     // committed seam is the hub render, so this case runs it unmocked.
-    it("on a hub, NEXT_PUBLIC_AILK_API_URL alone still counts as a hub address", async () => {
-      delete process.env.AILK_API_URL;
-      process.env.NEXT_PUBLIC_AILK_API_URL = HUB;
-      const res = await handleRelay(relayRequest("/v1/leads/submit"));
-      expect(res.status).toBe(201);
-      expect(fetchMock).toHaveBeenCalledTimes(1);
-    });
+    // #8060 — hub-only: a spoke render of the seam reads no
+    // NEXT_PUBLIC_AILK_API_URL, so a spoke scaffold skips this case.
+    (TOPOLOGY === "hub" ? it : it.skip)(
+      "on a hub, NEXT_PUBLIC_AILK_API_URL alone still counts as a hub address",
+      async () => {
+        delete process.env.AILK_API_URL;
+        process.env.NEXT_PUBLIC_AILK_API_URL = HUB;
+        const res = await handleRelay(relayRequest("/v1/leads/submit"));
+        expect(res.status).toBe(201);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+      },
+    );
 
     it("on a spoke (the seam's spoke render), that fallback is skipped", async () => {
       delete process.env.AILK_API_URL;

package/templates/apps/web/lib/__tests__/server-api.test.ts

@@ -11,6 +11,7 @@
  * sets `Origin`.
  */
 import { forwardedCookieInit } from "../server-api";
+import { TOPOLOGY } from "../topology.generated";
 
 const mockCookies = jest.fn();
 const mockHeaders = jest.fn();
@@ -27,35 +28,43 @@ describe("forwardedCookieInit", () => {
     mockHeaders.mockReset();
   });
 
-  it("forwards cookie + origin when the incoming request carries an Origin header", async () => {
-    mockCookies.mockResolvedValue({
-      toString: () => "better-auth.session_token=abc",
-    });
-    mockHeaders.mockResolvedValue(
-      new Headers({ origin: "https://app.example.com" }),
-    );
-
-    const init = await forwardedCookieInit();
-
-    expect(init).toEqual({
-      headers: {
-        cookie: "better-auth.session_token=abc",
-        origin: "https://app.example.com",
-      },
-    });
-  });
+  // #8060 — hub-only: a spoke render of the seam does not run this case.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "forwards cookie + origin when the incoming request carries an Origin header",
+    async () => {
+      mockCookies.mockResolvedValue({
+        toString: () => "better-auth.session_token=abc",
+      });
+      mockHeaders.mockResolvedValue(
+        new Headers({ origin: "https://app.example.com" }),
+      );
 
-  it("forwards cookie alone — no origin key at all — when Origin is absent", async () => {
-    mockCookies.mockResolvedValue({
-      toString: () => "better-auth.session_token=abc",
-    });
-    mockHeaders.mockResolvedValue(new Headers());
+      const init = await forwardedCookieInit();
 
-    const init = await forwardedCookieInit();
+      expect(init).toEqual({
+        headers: {
+          cookie: "better-auth.session_token=abc",
+          origin: "https://app.example.com",
+        },
+      });
+    },
+  );
 
-    expect(init).toEqual({
-      headers: { cookie: "better-auth.session_token=abc" },
-    });
-    expect(init.headers).not.toHaveProperty("origin");
-  });
+  // #8060 — hub-only: a spoke render of the seam does not run this case.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "forwards cookie alone — no origin key at all — when Origin is absent",
+    async () => {
+      mockCookies.mockResolvedValue({
+        toString: () => "better-auth.session_token=abc",
+      });
+      mockHeaders.mockResolvedValue(new Headers());
+
+      const init = await forwardedCookieInit();
+
+      expect(init).toEqual({
+        headers: { cookie: "better-auth.session_token=abc" },
+      });
+      expect(init.headers).not.toHaveProperty("origin");
+    },
+  );
 });

package/versions.json

@@ -29,7 +29,7 @@
   "@working-theory/schema-validator": "0.38.0",
   "@working-theory/sections-registry": "0.38.0",
   "@working-theory/site-config": "0.38.0",
-  "@working-theory/spoke-checkout": "0.3.0",
+  "@working-theory/spoke-checkout": "0.4.0",
   "@working-theory/stripe-client": "0.38.0",
   "@working-theory/templates": "0.38.0",
   "@working-theory/theme": "0.38.0",