create-ailk 0.17.0 → 0.19.0

package/templates/apps/web/lib/account-config.ts

@@ -1,11 +1,12 @@
 // account-config.ts — what the /account area is made of (#4984, #7429).
 //
-// The module contribution contract (spec 7423 D8, D8a): a module extends a
-// site's account area by adding entries to the three arrays below — Inbox
-// item kinds, User-settings sections and For-you sources — never a rail
-// entry. The contract's types live in `@working-theory/templates/account`; a
-// kind's label is a message key in the `account` namespace, and a For-you
-// item's strings are built through the context's `t`.
+// The module contribution contract (spec 7423 D8, D8a; #8231 D4): a module
+// extends a site's account area by adding entries to the five arrays below —
+// Inbox item kinds, User-settings sections, For-you sources, New actions and
+// Billing sections — never a rail entry. An absent module is an absent entry.
+// The contract's types live in `@working-theory/templates/account`; a kind's
+// label is a message key in the `account` namespace, and a For-you item's
+// strings are built through the context's `t`.
 //
 // `accountExperimentKeys` — mirrors `nav-config.ts`: the OSS template
 // declares NO experiments — nothing in `apps/web` runs a diagnostic today, so
@@ -20,51 +21,93 @@
 // The base contributions (D9, amended 2026-10-01 by D6a/D8a — #7448) use
 // existing reads only, each with the caller's cookie forwarded (`ctx.init`):
 //
-//   - Inbox kinds `result` and `purchase` — rows of the Recents and All tabs.
+//   - Inbox kind `result` — a row of the All tab.
 //   - For-you sources `email-unverified` and `payment-due` — needs-you items
-//     with an Open action to User settings (General, Billing), never Inbox
-//     rows. Neither read carries the time the condition began, so their time
+//     with an Open action to User settings' two pages, `/account/general`
+//     and `/account/billing` (#8232 D10), never Inbox rows. Neither read carries the time the condition began, so their time
 //     line is the date of the read rather than an invented "Waiting N".
 //
 // A 404 means "nothing for this caller" — no signup / no user row / commerce
 // module off — and loads `[]`; so does a 401/403 while the email is
 // unverified (the `email-unverified` item already says so). Any other
 // failure rejects — a 401/403 for a verified email included — so the area
-// shows an error row with Retry instead of an empty Inbox (D12). Scheduled
-// (the old Upcoming) stays empty in the base area; a module fills it.
+// shows an error row with Retry instead of an empty Inbox (D12).
 //
-// The member area's spoke leg (#7920) — the client's own records on the hub,
-// read by a spoke that signs its clients in through the hub (#7877, #7894):
+// The member reads (#7920, #8231 D5–D7) — the client's own records, through
+// one member API with two callers (roadmap D1): a single site's server calls
+// its own API with the caller's session cookie, and a spoke that signs its
+// clients in through the hub calls the hub with the client's hub credential.
+// `ctx.init` already carries the right one (`forwardedCookieInit()`), so no
+// kind here tests the topology:
 //
+//   - Inbox kind `purchase` (`GET /v1/member/purchases`) — the Purchases tab.
+//     Only a purchase linked by the verified-email rule shows (roadmap D3).
+//   - Inbox kind `appointment` (`GET /v1/member/appointments`) — the
+//     Scheduled tab, upcoming first, each item flagged by the read's own split.
 //   - Inbox kinds `piece` (`GET /v1/member/pieces`) and `message`
-//     (`GET /v1/member/messages`). A message with a file has a file action to
-//     this site's own member file read, `account/inbox/message/[id]/file`,
-//     which re-serves the hub's bytes — the browser holds no hub credential.
+//     (`GET /v1/member/messages`) — rows of All. A message with a file has a
+//     file action to this site's own member file read,
+//     `account/inbox/message/[id]/file`, which re-serves the bytes — the
+//     browser holds no hub credential.
 //   - For-you source `piece-needs-client` — each piece waiting on the client,
 //     with an Open action to its Inbox row. It shares the pieces read.
 //
-// The hub admits these reads only with the client's hub credential, which
-// `ctx.init` carries as `Authorization` on such a spoke and nowhere else. On a
-// cookie-session site (a hub, or a site with its own sign-in) there is none,
-// so the three make no call and load `[]` — inert, never an error row.
+// A build with no tenancy module registers no member route, so each of these
+// 404s and loads `[]`. A site whose workspace does not resolve gets a 503
+// from every member read — the error row — until it sets its own
+// `AILK_SPOKE_KEY` (#7633).
+//
+// The New actions (#8233, spec 8233 D1, D2) — the New menu over the Inbox.
+// Each is offered while its member read answers, read with `ctx.init` like
+// the kinds above, so a scaffold without a module shows no action that 404s
+// on click:
+//
+//   - `schedule-service` — while `GET /v1/member/meeting-types` answers
+//     (registered with `scheduling` on), `{ items: [] }` included: the
+//     popup then says no times are offered.
+//   - `request-quote` — while `GET /v1/member/request-form` answers a form;
+//     `{ form: null }` (switched off) leaves it out like a 404.
+//   - `send-message` — while `GET /v1/member/messages` answers; the `message`
+//     kind shares that read (`memberMessages`), one call per request.
+//
+// A Free build registers none of the three, so it shows no New button; a
+// failed read rejects, so the Inbox shows its error row. The popups, the
+// menu and their server actions are BASE files, never a module slice's:
+// gating is the read's job, and a slice owning a popup would pull this file,
+// hence the whole /account area, out of every keyless scaffold (#8233 C1 —
+// `paid-module-exclusions.test.ts` pins them).
+//
+// This file carries only each action's server half (`AccountNewRead`: id,
+// label, `available`); the popup each one opens is bound in the route,
+// `account/new-popups.tsx`, which composes the full `AccountNewAction` list
+// the Inbox page consumes. The reason is create-ailk's spoke closure
+// (`spokeExclusions`, `packages/create-ailk/src/topology.ts`): a spoke
+// without sign-in drops the whole `(authed)` group and every file that
+// imports a file in it, and this is a shared lib file every spoke keeps —
+// so it may import nothing under `(authed)`, popups included.
 
 import {
-  flowCheckouts,
   member,
   subscription,
   waitlistSignups,
-  type FlowCheckoutMeItem,
   type WaitlistSignupMeResponse,
 } from "@working-theory/api-client";
 import type {
+  AccountBillingSection,
   AccountContext,
   AccountForYouSource,
   AccountInboxKind,
+  AccountNewAction,
   AccountSettingsSection,
   AccountUser,
 } from "@working-theory/templates/account";
 import { localeHref } from "@working-theory/ui";
-import type { MemberMessage, MemberPiece } from "@working-theory/validation";
+import type {
+  MemberAppointment,
+  MemberMessage,
+  MemberPiece,
+  MemberPurchase,
+} from "@working-theory/validation";
 import { formatMoney, formatNumber } from "@working-theory/web-i18n";
 import { cache } from "react";
 
@@ -152,53 +195,46 @@ const result: AccountInboxKind<WaitlistSignupMeResponse> = {
   },
 };
 
-const purchase: AccountInboxKind<FlowCheckoutMeItem> = {
+// ── Member Inbox kinds (#7920, #8231) ────────────────────────────────────────
+
+const purchase: AccountInboxKind<MemberPurchase> = {
   kind: "purchase",
   label: "purchases.heading",
-  section: "updates",
+  section: "purchases",
   async load({ init, user }) {
-    const checkouts = (await read(flowCheckouts.me(init), user)) ?? [];
-    return checkouts.map((c) => ({
-      id: c.id,
-      title: c.offerKey,
-      at: c.completedAt ?? c.createdAt,
-      data: c,
+    const purchases = (await read(member.purchases(init), user))?.items ?? [];
+    return purchases.map((p) => ({
+      id: p.id,
+      title: p.offering,
+      at: p.purchasedAt,
+      data: p,
     }));
   },
   renderDetail({ data }, { locale, t }) {
     return {
-      status: data.status,
       fields: {
         heading: t("purchases.heading"),
         items: [
-          { label: t("purchases.offer"), value: data.offerKey },
+          { label: t("purchases.offer"), value: data.offering },
           {
             label: t("purchases.amount"),
-            value: formatMoney(data.amountMinor, data.currency, locale),
-          },
-          { label: t("purchases.period"), value: data.period },
-          {
-            label: t("purchases.date"),
-            value: formatWhen(data.completedAt ?? data.createdAt, locale),
+            value:
+              data.amountMinor !== null && data.currency !== null
+                ? formatMoney(data.amountMinor, data.currency, locale)
+                : t("purchases.unavailable"),
           },
+          { label: t("purchases.period"), value: data.period ?? t("purchases.unavailable") },
+          { label: t("purchases.date"), value: formatWhen(data.purchasedAt, locale) },
         ],
       },
     };
   },
 };
 
-// ── Member Inbox kinds (#7920) ───────────────────────────────────────────────
-
-/** Whether `init` carries the client's hub credential (see the header). */
-function hasHubCredential({ init }: AccountContext): boolean {
-  return Object.keys(init.headers).some((name) => name.toLowerCase() === "authorization");
-}
-
 /** One pieces read per request — the `piece` kind and the For-you source share it. */
 const memberPieces = cache((init: AccountContext["init"]) => member.pieces(init));
 
 async function loadPieces(ctx: AccountContext): Promise<MemberPiece[]> {
-  if (!hasHubCredential(ctx)) return [];
   return (await read(memberPieces(ctx.init), ctx.user))?.items ?? [];
 }
 
@@ -230,13 +266,15 @@ const piece: AccountInboxKind<MemberPiece> = {
   },
 };
 
+/** One messages read per request — the `message` kind and the Send message action share it. */
+const memberMessages = cache((init: AccountContext["init"]) => member.messages(init));
+
 const message: AccountInboxKind<MemberMessage> = {
   kind: "message",
   label: "messages.heading",
   section: "updates",
   async load(ctx) {
-    if (!hasHubCredential(ctx)) return [];
-    const messages = (await read(member.messages(ctx.init), ctx.user))?.items ?? [];
+    const messages = (await read(memberMessages(ctx.init), ctx.user))?.items ?? [];
     return messages.map((m) => ({
       id: m.id,
       title: m.subject,
@@ -273,6 +311,47 @@ const message: AccountInboxKind<MemberMessage> = {
   },
 };
 
+/** Each appointment status's message key — a new status is a type error, never a raw key. */
+const APPOINTMENT_STATUS_KEY = {
+  pending: "appointments.statuses.pending",
+  confirmed: "appointments.statuses.confirmed",
+  cancelled: "appointments.statuses.cancelled",
+} satisfies Record<MemberAppointment["status"], string>;
+
+const appointment: AccountInboxKind<MemberAppointment> = {
+  kind: "appointment",
+  label: "appointments.heading",
+  section: "upcoming",
+  async load({ init, t, user }) {
+    const appointments = await read(member.appointments(init), user);
+    if (appointments === null) return [];
+    // The read's own split decides upcoming — a meeting in progress is upcoming.
+    const toItem = (a: MemberAppointment, upcoming: boolean) => ({
+      id: a.id,
+      title: a.title ?? t("appointments.untitled"),
+      at: a.startTime,
+      upcoming,
+      data: a,
+    });
+    return [
+      ...appointments.upcoming.map((a) => toItem(a, true)),
+      ...appointments.past.map((a) => toItem(a, false)),
+    ];
+  },
+  renderDetail({ data }, { locale, t }) {
+    return {
+      status: t(APPOINTMENT_STATUS_KEY[data.status]),
+      fields: {
+        heading: t("appointments.heading"),
+        items: [
+          { label: t("appointments.starts"), value: formatWhen(data.startTime, locale) },
+          { label: t("appointments.ends"), value: formatWhen(data.endTime, locale) },
+        ],
+      },
+    };
+  },
+};
+
 // ── Base For-you sources (D9 as amended, D8a) ────────────────────────────────
 
 const emailUnverified: AccountForYouSource = {
@@ -285,7 +364,7 @@ const emailUnverified: AccountForYouSource = {
         type: { id: "email", label: t("profile.email"), tone: "needs-you" },
         title: t("profile.unverified"),
         time: { kind: "at", at: new Date().toISOString() },
-        action: { kind: "open", href: localeHref(locale, "/account/settings#general") },
+        action: { kind: "open", href: localeHref(locale, "/account/general") },
         dismissible: true,
       },
     ];
@@ -304,7 +383,7 @@ const paymentDue: AccountForYouSource = {
         type: { id: "payment", label: t("subscription.action"), tone: "needs-you" },
         title: t("subscription.headline"),
         time: { kind: "at", at: new Date().toISOString() },
-        action: { kind: "open", href: localeHref(locale, "/account/settings#billing") },
+        action: { kind: "open", href: localeHref(locale, "/account/billing") },
         dismissible: true,
       },
     ];
@@ -334,14 +413,71 @@ const pieceNeedsClient: AccountForYouSource = {
   },
 };
 
+// ── New actions (#8233) ──────────────────────────────────────────────────────
+
+/**
+ * A New action's server half — everything but the popup it opens, which
+ * `account/new-popups.tsx` binds (see the header: this file imports nothing
+ * under `(authed)`).
+ */
+export type AccountNewRead = Omit<AccountNewAction, "renderPopup">;
+
+const scheduleService = {
+  id: "schedule-service",
+  label: "new.actions.scheduleService",
+  async available({ init, user }) {
+    return (await read(member.meetingTypes(init), user)) !== null;
+  },
+} as const satisfies AccountNewRead;
+
+const requestQuote = {
+  id: "request-quote",
+  label: "new.actions.requestQuote",
+  async available({ init, user }) {
+    // `form: null` is Request quote switched off — a state, never a 404.
+    return ((await read(member.requestForm(init), user))?.form ?? null) !== null;
+  },
+} as const satisfies AccountNewRead;
+
+const sendMessage = {
+  id: "send-message",
+  label: "new.actions.sendMessage",
+  async available({ init, user }) {
+    return (await read(memberMessages(init), user)) !== null;
+  },
+} as const satisfies AccountNewRead;
+
 // ── Contributions ─────────────────────────────────────────────────────────────
 
 /** Inbox item kinds, in load order. A module appends its own. */
-export const accountInboxKinds: AccountInboxKind[] = [result, purchase, piece, message];
+export const accountInboxKinds: AccountInboxKind[] = [
+  result,
+  purchase,
+  piece,
+  message,
+  appointment,
+];
 
 /** User-settings sections a module adds after the base ones. None in the base area. */
 export const accountSettingsSections: AccountSettingsSection[] = [];
 
+/**
+ * New-menu actions' server halves, in menu order (#8233 D2). A module appends
+ * its own read here and binds its popup in `account/new-popups.tsx`, keyed on
+ * the id — `AccountNewActionId` makes a read with no popup a type error.
+ */
+export const accountNewActions = [
+  scheduleService,
+  requestQuote,
+  sendMessage,
+] as const satisfies readonly AccountNewRead[];
+
+/** The ids `accountNewActions` carries — the keys `new-popups.tsx` must bind. */
+export type AccountNewActionId = (typeof accountNewActions)[number]["id"];
+
+/** Billing-page sections a module adds after the base ones. `member-settings` (#8232) renders it. */
+export const accountBillingSections: AccountBillingSection[] = [];
+
 /** For-you sources, in load order. A module appends its own. */
 export const accountForYouSources: AccountForYouSource[] = [
   emailUnverified,

package/templates/apps/web/lib/hub-session/__tests__/hub-session.test.ts

@@ -34,8 +34,11 @@ jest.mock("../../topology.generated", () => ({
   SIGN_IN_PROVIDER: "hub",
 }));
 
+import { cookies } from "next/headers";
+
 import { forwardedCookieInit } from "../../server-api";
 import { hubSessionConfig } from "../config";
+import { resealHubSession } from "../reseal";
 import { seal, unseal } from "../seal";
 import {
   type HubSessionPayload,
@@ -115,6 +118,29 @@ describe("seal", () => {
     expect(unseal("", SESSION_SECRET, "session", COOKIE)).toBeNull();
   });
 
+  // #8146 AC-4: the `continue` purpose was added to seal.ts. These two
+  // ciphertexts were sealed on `main` BEFORE that edit and committed as
+  // literals, so any change to INFO.session, INFO.flow or deriveKey fails
+  // here — the round trips above cannot see a key change (a changed key still
+  // round-trips with itself, and would silently log out every live spoke).
+  it("still opens a `session` value sealed before the `continue` purpose existed", () => {
+    const sealed =
+      "T0OSblxM1tRcJ4f5OP4VDvQA5TvWQdW3K_GvZlFzETSgVCw1tzEEaDWfAhHz0HZgY1sg8vA2fy0au73t";
+    expect(unseal(sealed, SESSION_SECRET, "session", COOKIE)).toEqual({
+      v: 1,
+      fixed: "session-vector",
+    });
+  });
+
+  it("still opens a `flow` value sealed before the `continue` purpose existed", () => {
+    const sealed =
+      "TI60LmvzNlRIp6a4BexFT9zmNoOWn8ZYBhW2VtOklk6lwUtrEWwtJ15XSJeAfgeNpSc322z-PWlZ";
+    expect(unseal(sealed, SESSION_SECRET, "flow", "ailk-hub-flow")).toEqual({
+      v: 1,
+      fixed: "flow-vector",
+    });
+  });
+
   it("uses a fresh IV per seal", () => {
     expect(seal({ a: 1 }, SESSION_SECRET, "session", COOKIE)).not.toBe(
       seal({ a: 1 }, SESSION_SECRET, "session", COOKIE),
@@ -260,3 +286,120 @@ describe("hubNextPath", () => {
     expect(hubNextPath(raw)).toBe(expected);
   });
 });
+
+// #8232 D11 (spec docs/specs/8232-member-settings-account-general-and-spec.md
+// AC-5) — after a member's profile save, the spoke re-seals its session from
+// the hub's /me. Only `user` changes; the credential and its expiry are kept,
+// so a re-seal never extends a session (SEC-8232-1), and the cookie is
+// written with the attributes the callback writes at sign-in (SEC-8232-2).
+describe("#8232 AC-5 — resealHubSession", () => {
+  const mockSet = jest.fn();
+  const RENAMED = { ...USER, name: "Ada King" };
+
+  beforeEach(() => {
+    mockSet.mockReset();
+    jest.mocked(cookies).mockResolvedValue({ set: mockSet } as never);
+  });
+
+  function signedIn(overrides: Partial<HubSessionPayload> = {}, name = COOKIE): void {
+    mockHeaders.mockResolvedValue(headersWith(seal(payload(overrides), SESSION_SECRET, "session", name), name));
+  }
+
+  it("re-seals the session with /me's person, keeping the credential and expiry, once, with the sign-in attributes", async () => {
+    const expiresAt = Date.now() + 60_000;
+    signedIn({ expiresAt });
+    mockMe.mockResolvedValue({ ok: true, body: { user: RENAMED, billingCustomerId: null } });
+
+    await expect(resealHubSession()).resolves.toBe("resealed");
+
+    expect(mockMe).toHaveBeenCalledTimes(1);
+    expect(mockMe).toHaveBeenCalledWith({ headers: { authorization: `Bearer ${CREDENTIAL}` } });
+    expect(mockSet).toHaveBeenCalledTimes(1);
+    const [name, value, options] = mockSet.mock.calls[0] as [string, string, Record<string, unknown>];
+    expect(name).toBe(COOKIE);
+    expect(options).toEqual({
+      httpOnly: true,
+      sameSite: "lax",
+      path: "/",
+      secure: false,
+      maxAge: expect.any(Number),
+    });
+    expect(options["maxAge"]).toBeGreaterThan(0);
+    expect(options["maxAge"]).toBeLessThanOrEqual(60);
+    expect(unseal(value, SESSION_SECRET, "session", COOKIE)).toEqual({
+      v: 1,
+      accessToken: CREDENTIAL,
+      expiresAt,
+      user: RENAMED,
+    });
+  });
+
+  it("writes the __Host- cookie with Secure on an https site", async () => {
+    configure({ NEXT_PUBLIC_BASE_URL: "https://spoke.example.com" });
+    signedIn({}, "__Host-ailk-hub-session");
+    mockMe.mockResolvedValue({ ok: true, body: { user: RENAMED, billingCustomerId: null } });
+
+    await expect(resealHubSession()).resolves.toBe("resealed");
+    const [name, , options] = mockSet.mock.calls[0] as [string, string, Record<string, unknown>];
+    expect(name).toBe("__Host-ailk-hub-session");
+    expect(options).toMatchObject({ secure: true, httpOnly: true });
+  });
+
+  it("is skipped with no configuration (a single site), calling neither /me nor set", async () => {
+    signedIn();
+    configure({ AILK_HUB_SESSION_SECRET: undefined });
+    await expect(resealHubSession()).resolves.toBe("skipped");
+    expect(mockMe).not.toHaveBeenCalled();
+    expect(mockSet).not.toHaveBeenCalled();
+  });
+
+  it("is skipped with no session cookie, calling neither /me nor set", async () => {
+    mockHeaders.mockResolvedValue(new Headers());
+    await expect(resealHubSession()).resolves.toBe("skipped");
+    expect(mockMe).not.toHaveBeenCalled();
+    expect(mockSet).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ["a non-2xx", () => mockMe.mockResolvedValue({ ok: false, status: 401, body: null })],
+    ["a throw", () => mockMe.mockRejectedValue(new Error("network"))],
+    [
+      "a user with a non-string email",
+      () => mockMe.mockResolvedValue({ ok: true, body: { user: { ...RENAMED, email: 42 }, billingCustomerId: null } }),
+    ],
+    [
+      "a user with a non-boolean emailVerified",
+      () =>
+        mockMe.mockResolvedValue({ ok: true, body: { user: { ...RENAMED, emailVerified: "yes" }, billingCustomerId: null } }),
+    ],
+    [
+      "a user with a non-string createdAt",
+      () => mockMe.mockResolvedValue({ ok: true, body: { user: { ...RENAMED, createdAt: 1 }, billingCustomerId: null } }),
+    ],
+    [
+      "a user whose name is neither a string nor null",
+      () => mockMe.mockResolvedValue({ ok: true, body: { user: { ...RENAMED, name: 7 }, billingCustomerId: null } }),
+    ],
+  ])("fails on %s from /me and leaves the cookie as it is", async (_label, arrange) => {
+    signedIn();
+    arrange();
+    await expect(resealHubSession()).resolves.toBe("failed");
+    expect(mockSet).not.toHaveBeenCalled();
+  });
+
+  it("is skipped when the session has under a second left, with no call and no write", async () => {
+    signedIn({ expiresAt: Date.now() + 500 });
+    await expect(resealHubSession()).resolves.toBe("skipped");
+    expect(mockMe).not.toHaveBeenCalled();
+    expect(mockSet).not.toHaveBeenCalled();
+  });
+
+  it("fails, never throws, when the cookie write is refused", async () => {
+    signedIn();
+    mockMe.mockResolvedValue({ ok: true, body: { user: RENAMED, billingCustomerId: null } });
+    mockSet.mockImplementation(() => {
+      throw new Error("Cookies can only be modified in a Server Action or Route Handler");
+    });
+    await expect(resealHubSession()).resolves.toBe("failed");
+  });
+});

package/templates/apps/web/lib/hub-session/index.ts

@@ -21,3 +21,4 @@ export {
   hubSessionInit,
   readHubSession,
 } from "./session";
+export { resealHubSession } from "./reseal";

package/templates/apps/web/lib/hub-session/reseal.ts

@@ -0,0 +1,90 @@
+/**
+ * The spoke's session re-seal (#8232, spec
+ * docs/specs/8232-member-settings-account-general-and-spec.md D11; roadmap
+ * D9).
+ *
+ * After a member saves their name through the hub (`PATCH /v1/member/profile`),
+ * the sealed session cookie still names the person as they were at sign-in.
+ * `resealHubSession()` re-reads the person from the hub's own record,
+ * `GET /v1/hub-sign-in/me`, with the session's credential, and writes the
+ * cookie again so the next render shows the new name:
+ *
+ *   - no hub-session configuration (a single site) or no session cookie ⇒
+ *     `"skipped"`, with no call;
+ *   - `/me` refusing, throwing, or answering a person of the wrong shape ⇒
+ *     `"failed"`, and the cookie is left as it is (sign-out is the sign-out
+ *     route's job — a transient hub error never signs the member out);
+ *   - otherwise only `user` changes. `v`, `accessToken` and `expiresAt` are
+ *     kept exactly and `Max-Age` is the remaining lifetime, so a re-seal
+ *     never extends a session (SEC-8232-1). The cookie's name, key and
+ *     attributes are the ones the callback route writes at sign-in
+ *     (`cookieHeader`: `HttpOnly`, `SameSite=Lax`, `Path=/`, `Secure` on an
+ *     https site — SEC-8232-2).
+ *
+ * It tests no topology: a single site has no configuration and no cookie.
+ * Nothing here logs a credential, a cookie value, a name or an email.
+ */
+
+import { hubSignIn } from "@working-theory/api-client";
+import { cookies, headers } from "next/headers";
+
+import { hubSessionConfig } from "./config";
+import { seal } from "./seal";
+import { type HubSessionUser, readHubSessionPayload, sessionCookieName } from "./session";
+
+/**
+ * The person `/me` names, when every field is the type the session holds.
+ * It repeats `session.ts`'s private shape check on purpose: `sync-routes`
+ * brings this file to a scaffold whose own `session.ts` it never updates,
+ * so it cannot rely on a new export there.
+ */
+function sessionUser(value: unknown): HubSessionUser | null {
+  if (typeof value !== "object" || value === null) return null;
+  const user = value as Record<string, unknown>;
+  const { name, email, emailVerified, createdAt } = user;
+  if (
+    typeof email !== "string" ||
+    typeof emailVerified !== "boolean" ||
+    typeof createdAt !== "string" ||
+    (name !== null && typeof name !== "string")
+  ) {
+    return null;
+  }
+  return { name, email, emailVerified, createdAt };
+}
+
+/** Re-seals the hub session cookie from the hub's `/me`. Never throws. */
+export async function resealHubSession(): Promise<"resealed" | "skipped" | "failed"> {
+  const config = hubSessionConfig();
+  if (config === null) return "skipped";
+  const payload = readHubSessionPayload(await headers());
+  if (payload === null) return "skipped";
+  const maxAge = Math.floor((payload.expiresAt - Date.now()) / 1000);
+  if (maxAge <= 0) return "skipped";
+
+  let user: HubSessionUser | null;
+  try {
+    const res = await hubSignIn.me({
+      headers: { authorization: `Bearer ${payload.accessToken}` },
+    });
+    user = res.ok ? sessionUser(res.body.user) : null;
+  } catch {
+    user = null;
+  }
+  if (user === null) return "failed";
+
+  const name = sessionCookieName(config);
+  try {
+    (await cookies()).set(name, seal({ ...payload, user }, config.sessionSecret, "session", name), {
+      httpOnly: true,
+      sameSite: "lax",
+      path: "/",
+      maxAge,
+      secure: config.secure,
+    });
+  } catch {
+    // Outside a Server Action or route handler Next refuses a cookie write.
+    return "failed";
+  }
+  return "resealed";
+}

package/templates/apps/web/lib/hub-session/seal.ts

@@ -1,12 +1,15 @@
 /**
- * Sealed cookie values for the spoke's hub session (#7894 D7).
+ * Sealed values for the hub sign-in (#7894 D7, #8146 D3).
  *
- * AES-256-GCM with a fresh 12-byte IV per seal. The key is HKDF-SHA256 of
- * `AILK_HUB_SESSION_SECRET` with one info string per cookie purpose, so the
- * session cookie and the flow cookie never share a key, and the cookie's NAME
- * is the additional authenticated data, so a value sealed for one cookie never
- * opens as the other. The key never derives from the client secret: a leaked
- * client secret forges no spoke session.
+ * AES-256-GCM with a fresh 12-byte IV per seal. The key is HKDF-SHA256 of the
+ * caller's secret with one info string per purpose, so the three purposes
+ * never share a key, and the caller-supplied name is the additional
+ * authenticated data, so a value sealed for one name never opens as another.
+ * Two secrets feed this module: `AILK_HUB_SESSION_SECRET` for the spoke's
+ * `session` and `flow` cookies, and `BETTER_AUTH_SECRET` for the hub's
+ * `continue` ref (`app/api/auth/hub/continuation.ts`, hub and standalone
+ * sites only; the entry is unused on a spoke). The key never derives from the
+ * client secret: a leaked client secret forges no spoke session.
  *
  * Wire form: base64url(iv ‖ tag ‖ ciphertext). Anything that does not open —
  * a wrong key, a wrong name, a truncated or altered value — reads as `null`,
@@ -20,12 +23,13 @@ import {
   randomBytes,
 } from "node:crypto";
 
-/** The two things this module seals, each under its own derived key. */
-export type SealPurpose = "session" | "flow";
+/** The things this module seals, each under its own derived key. */
+export type SealPurpose = "session" | "flow" | "continue";
 
 const INFO: Record<SealPurpose, string> = {
   session: "ailk-hub-session/v1",
   flow: "ailk-hub-flow/v1",
+  continue: "ailk-hub-continue/v1",
 };
 
 const IV_BYTES = 12;