create-ailk 0.18.0 → 0.19.0

package/templates/apps/web/app/[locale]/(authed)/account/sign-in-method.ts

@@ -0,0 +1,37 @@
+/**
+ * account/sign-in-method.ts (server code) — how a member signs in, for User settings ›
+ * General's Sign-in section (#8232, spec
+ * docs/specs/8232-member-settings-account-general-and-spec.md D7).
+ *
+ * One of the account tree's TWO topology seams (roadmap D1; the other is
+ * `billing-source.ts`): no other file under the account tree tests
+ * `SIGN_IN_PROVIDER`, `TOPOLOGY` or `SIGN_IN_ENABLED`.
+ *
+ *   - A spoke that signs in through its hub (`SIGN_IN_PROVIDER === "hub"`,
+ *     #7894) answers `hub`, with the hub's host when it is configured.
+ *   - Any other site answers `site`, with the sign-in methods this deployment
+ *     has configured. Better Auth's session does not say which one this
+ *     member used, so the list is the deployment's (C7).
+ */
+
+import { getActiveProviderIds } from "../../../../lib/auth-env";
+import { hubSessionConfig } from "../../../../lib/hub-session/config";
+import { SIGN_IN_PROVIDER } from "../../../../lib/topology.generated";
+
+/** The sign-in methods General names, in the order it lists them. */
+export const SIGN_IN_METHODS = ["google", "github", "magic-link", "email"] as const;
+
+export type SignInMethodId = (typeof SIGN_IN_METHODS)[number];
+
+export type SignInMethod =
+  | { kind: "hub"; hubHost: string | null }
+  | { kind: "site"; methods: SignInMethodId[] };
+
+export function signInMethod(): SignInMethod {
+  if (SIGN_IN_PROVIDER === "hub") {
+    const config = hubSessionConfig();
+    return { kind: "hub", hubHost: config === null ? null : new URL(config.hubOrigin).host };
+  }
+  const active = new Set(getActiveProviderIds());
+  return { kind: "site", methods: SIGN_IN_METHODS.filter((id) => active.has(id)) };
+}

package/templates/apps/web/app/[locale]/(authed)/account/support-actions.ts

@@ -4,9 +4,12 @@
  * account/support-actions.ts — the account area's Support request action.
  *
  * `submitSupportRequest` (#7430, spec 7423 D11) — files a Support request
- * (and, from User settings › Privacy, an account-deletion request) as a
- * contact lead: `POST /v1/leads/submit` with `source: "web"`, the session's
- * email and the payload `{ kind, subject, message }`. No `siteId` — the
+ * as a contact lead: `POST /v1/leads/submit` with `source: "web"`, the
+ * session's email and the payload `{ kind: "support", subject, message }`.
+ * Every request it files is `support`, whatever is posted (#8232 D12): an
+ * account-deletion request goes through `member.requestDeletion`
+ * (`profile-actions.ts`), which files it with the deployment that holds the
+ * account, so this action needs no topology test (SEC-7894-11). No `siteId` — the
  * route resolves the tenant server-side and ignores a posted one (#6203).
  * The request lands in the admin Inbox as a message. Not a `*Action`-suffixed
  * export in a `*.actions.ts` file: lead capture already has its MCP twin
@@ -21,7 +24,7 @@
 import { leads, visitorForwardHeaders } from "@working-theory/api-client";
 import { headers } from "next/headers";
 
-import { SIGN_IN_PROVIDER, readSession } from "../../../../lib/topology.generated";
+import { readSession } from "../../../../lib/topology.generated";
 
 /** PII-safe error identity for logs (the `checkout.actions.ts` idiom: `err.name` only). */
 function errorName(err: unknown): string {
@@ -53,7 +56,7 @@ function isNotConfigured(res: { status: number; body: unknown }): boolean {
 }
 
 /**
- * Files the signed-in member's Support (or deletion) request. The email is
+ * Files the signed-in member's Support request. The email is
  * the session's own — never a form field — so a request always names the
  * person who sent it.
  */
@@ -61,10 +64,6 @@ export async function submitSupportRequest(
   _prev: SupportRequestState,
   formData: FormData,
 ): Promise<SupportRequestState> {
-  // A hub sign-in spoke's account belongs to the hub, whose own settings take
-  // a deletion request (#7894 D10, SEC-7894-11): here it can only be support.
-  const kind =
-    field(formData, "kind") === "deletion" && SIGN_IN_PROVIDER !== "hub" ? "deletion" : "support";
   const subject = field(formData, "subject");
   const message = field(formData, "message");
   if (!subject || !message || subject.length > MAX_SUBJECT || message.length > MAX_MESSAGE) {
@@ -79,7 +78,7 @@ export async function submitSupportRequest(
     const body = {
       source: "web",
       email: session.user.email,
-      payload: { kind, subject, message },
+      payload: { kind: "support", subject, message },
     };
     // #7394 — a spoke counts the request against the visitor's own budget.
     const forwarded = visitorForwardHeaders(

package/templates/apps/web/app/[locale]/layout.tsx

@@ -27,6 +27,7 @@ import "../globals.css";
 
 import { Telemetry, VerificationMeta } from "@working-theory/analytics";
 import { MarketingShell } from "@working-theory/templates/shells";
+import { themeToShellCss } from "@working-theory/theme";
 import { Link, isRtl, localeHref } from "@working-theory/ui";
 import { BRAND_PATHS, LocaleSwitcherNav } from "@working-theory/ui/blocks";
 import {
@@ -58,7 +59,11 @@ import { assertEnabledLocale } from "../../lib/locale-guard";
 import { footerColumns, navItems } from "../../lib/nav-config";
 import { getOgImageUrl } from "../../lib/og";
 import { backLinkHref } from "../../lib/profile-back-link";
-import { COPYRIGHT_HOLDER, SITE_NAME } from "../../lib/site-brand";
+import {
+  COPYRIGHT_HOLDER,
+  SITE_DESCRIPTION,
+  SITE_NAME,
+} from "../../lib/site-brand";
 import { siteChrome, type SiteChrome } from "../../lib/site-chrome";
 import { siteLogo } from "../../lib/site-logo";
 // Registers the `_site.mdx` identity with page-renderer at module load, so
@@ -126,6 +131,11 @@ const NAV_CLIENT_ACTION_FLOW: NavActionFlow["flow"] = {
   action: "#",
 };
 
+// The member account shell's token reset (#8337 D3) — a package constant
+// (no site, request or user input), computed once at module scope and
+// emitted only on account routes, after `theme-vars`, below.
+const SHELL_CSS = themeToShellCss();
+
 // ── Theme helpers ────────────────────────────────────────────────────────────
 
 /**
@@ -214,10 +224,10 @@ export async function generateMetadata(): Promise<Metadata> {
 
   return {
     title: SITE_NAME,
-    description: "AX-first OSS template — API + MCP as canonical surfaces.",
+    description: SITE_DESCRIPTION,
     openGraph: {
       title: SITE_NAME,
-      description: "AX-first OSS template — API + MCP as canonical surfaces.",
+      description: SITE_DESCRIPTION,
       type: "website",
       url: baseUrl,
       images: [ogImageUrl],
@@ -225,7 +235,7 @@ export async function generateMetadata(): Promise<Metadata> {
     twitter: {
       card: "summary_large_image",
       title: SITE_NAME,
-      description: "AX-first OSS template — API + MCP as canonical surfaces.",
+      description: SITE_DESCRIPTION,
       images: [ogImageUrl],
     },
     ...getStealthRobots(),
@@ -617,6 +627,15 @@ export default async function LocaleLayout({
           data-ailk="theme-vars"
           dangerouslySetInnerHTML={{ __html: themeHead.css }}
         />
+        {/* The member account shell's token reset (#8337 D3) — account
+            routes only, after theme-vars, so :has([data-ailk-shell])'s
+            higher specificity wins whatever a browser's :has() support. */}
+        {isAccountRoute ? (
+          <style
+            data-ailk="shell-vars"
+            dangerouslySetInnerHTML={{ __html: SHELL_CSS }}
+          />
+        ) : null}
         {/* Favicons — single brand mark (theme-independent), PNG fallbacks, ICO legacy */}
         <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
         <link

package/templates/apps/web/app/api/auth/hub/__tests__/continuation.test.ts

@@ -0,0 +1,143 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * The hub's sign-in continuation module (#8146 D3; spec AC-3(b), AC-4).
+ * Pure functions over `seal.ts`; no mocks.
+ */
+import { seal } from "../../../../../lib/hub-session/seal";
+import {
+  CONTINUATION_REF_MAX,
+  CONTINUATION_TTL_SECONDS,
+  CONTINUE_PATH,
+  mintContinuation,
+  openContinuation,
+} from "../continuation";
+
+const SECRET = "k".repeat(43);
+const T = 1_790_000_000_000;
+
+const Q = new URLSearchParams({
+  response_type: "code",
+  client_id: "spoke_abc",
+  redirect_uri: "https://spoke.example.com/api/hub-session/callback",
+  state: "s".repeat(43),
+  code_challenge: "c".repeat(43),
+  code_challenge_method: "S256",
+}).toString();
+
+describe("constants", () => {
+  it("pins the path, the ref cap and the 600 s life", () => {
+    expect(CONTINUE_PATH).toBe("/api/auth/hub/continue");
+    expect(CONTINUATION_REF_MAX).toBe(4096);
+    expect(CONTINUATION_TTL_SECONDS).toBe(600);
+  });
+});
+
+describe("AC-4 — the continuation lives 600 s and round-trips", () => {
+  it("opens to the query it was minted from, up to the last millisecond", () => {
+    const ref = mintContinuation(Q, SECRET, T);
+    expect(openContinuation(ref, SECRET, T + 599_000)).toBe(Q);
+    expect(openContinuation(ref, SECRET, T + 599_999)).toBe(Q);
+  });
+
+  it("is gone at exactly 600 s (exp <= now)", () => {
+    const ref = mintContinuation(Q, SECRET, T);
+    expect(openContinuation(ref, SECRET, T + 600_000)).toBeNull();
+    expect(openContinuation(ref, SECRET, T + 600_001)).toBeNull();
+  });
+
+  it("is base64url only, so no decode can change it", () => {
+    const ref = mintContinuation(Q, SECRET, T);
+    expect(ref).toMatch(/^[A-Za-z0-9_-]+$/);
+    expect(decodeURIComponent(decodeURIComponent(ref))).toBe(ref);
+    expect(ref.length).toBeLessThan(CONTINUATION_REF_MAX);
+  });
+});
+
+describe("AC-3(b) — a ref that is not ours opens to null", () => {
+  const good = mintContinuation(Q, SECRET, T);
+
+  it("flips the first character", () => {
+    const flipped = (good[0] === "A" ? "B" : "A") + good.slice(1);
+    expect(openContinuation(flipped, SECRET, T)).toBeNull();
+  });
+
+  it("sealed under another secret", () => {
+    const other = mintContinuation(Q, "x".repeat(43), T);
+    expect(openContinuation(other, SECRET, T)).toBeNull();
+  });
+
+  it('a valid payload sealed with purpose "flow" and the SAME AAD (only the key differs)', () => {
+    const forged = seal(
+      { v: 1, q: Q, exp: T + 600_000 },
+      SECRET,
+      "flow",
+      "hub-continue",
+    );
+    expect(openContinuation(forged, SECRET, T)).toBeNull();
+  });
+
+  it("a value sealed under another name never opens as a continuation", () => {
+    const forged = seal(
+      { v: 1, q: Q, exp: T + 600_000 },
+      SECRET,
+      "continue",
+      "ailk-hub-flow",
+    );
+    expect(openContinuation(forged, SECRET, T)).toBeNull();
+  });
+
+  it("exp in the past", () => {
+    const expired = seal(
+      { v: 1, q: Q, exp: T - 1 },
+      SECRET,
+      "continue",
+      "hub-continue",
+    );
+    expect(openContinuation(expired, SECRET, T)).toBeNull();
+  });
+
+  it("4097 characters", () => {
+    expect(openContinuation("A".repeat(4097), SECRET, T)).toBeNull();
+  });
+
+  it("a character outside base64url", () => {
+    expect(openContinuation(`${good}%`, SECRET, T)).toBeNull();
+    expect(openContinuation(`${good}?x=1`, SECRET, T)).toBeNull();
+    expect(openContinuation("", SECRET, T)).toBeNull();
+  });
+
+  it("the base64url of plain JSON, unsealed", () => {
+    const plain = Buffer.from(
+      JSON.stringify({ v: 1, q: Q, exp: T + 600_000 }),
+    ).toString("base64url");
+    expect(openContinuation(plain, SECRET, T)).toBeNull();
+  });
+
+  it.each([
+    ["a wrong version", { v: 2, q: Q, exp: T + 1000 }],
+    ["an empty q", { v: 1, q: "", exp: T + 1000 }],
+    ["a non-string q", { v: 1, q: 5, exp: T + 1000 }],
+    ["a non-number exp", { v: 1, q: Q, exp: "later" }],
+    ["a bare string", "hello"],
+    ["null", null],
+  ])("a sealed value with %s", (_name, value) => {
+    const ref = seal(value, SECRET, "continue", "hub-continue");
+    expect(openContinuation(ref, SECRET, T)).toBeNull();
+  });
+
+  it("re-serializes a forged q so a CR/LF is percent-encoded and never throws", () => {
+    const ref = seal(
+      { v: 1, q: "a=1\r\nX-Injected: 1", exp: T + 600_000 },
+      SECRET,
+      "continue",
+      "hub-continue",
+    );
+    const opened = openContinuation(ref, SECRET, T);
+    expect(opened).not.toBeNull();
+    expect(opened).not.toMatch(/[\r\n]/);
+    expect(() => new Headers({ Location: `/x?${opened}` })).not.toThrow();
+  });
+});

package/templates/apps/web/app/api/auth/hub/authorize/__tests__/route.test.ts

@@ -15,12 +15,14 @@
 // --- Mocks set up BEFORE imports ---
 
 const mockGetSession = jest.fn();
+const mockSecret = "k".repeat(43);
 // eslint-disable-next-line no-restricted-syntax -- auth.ts is the Better Auth singleton (its adapter needs a live database); this stand-in for the session read is the repo-standard double for that boundary (see the sibling suites under app/[locale]/(authed)/account/__tests__).
 jest.mock("../../../../../../auth", () => ({
   __esModule: true,
   auth: {
     api: { getSession: (...args: unknown[]) => mockGetSession(...args) },
   },
+  resolveSecret: () => mockSecret,
 }));
 
 const mockCreateCode = jest.fn();
@@ -30,9 +32,11 @@ jest.mock("@working-theory/api-client", () => ({
 }));
 
 import { resolveNextPath } from "../../../../../[locale]/(auth)/sign-in/next-path";
+import { openContinuation } from "../../continuation";
 import { GET } from "../route";
 
 const HUB = "https://hub.example.com";
+const CONTINUE = "/api/auth/hub/continue";
 const SPOKE_CALLBACK = "https://spoke.example.com/api/hub-session/callback";
 const CHALLENGE = "c".repeat(43);
 const STATE = "s".repeat(43);
@@ -102,34 +106,82 @@ describe("a malformed query is a 400 and never a redirect", () => {
 });
 
 describe("no Better Auth session", () => {
-  it("AC-4: 303 to /sign-in?next= followed by the encoded authorize path and query", async () => {
+  /** The `next` value of the 303, and the ref inside it. */
+  function continuationOf(res: Response): { next: string; ref: string } {
+    const location = res.headers.get("location") ?? "";
+    const next = new URL(location, HUB).searchParams.get("next") ?? "";
+    return { next, ref: next.slice(`${CONTINUE}/`.length) };
+  }
+
+  it("#8146 AC-1(b): 303 to /sign-in?next= followed by the encoded continue path and a sealed ref", async () => {
     mockGetSession.mockResolvedValue(null);
     const search = query();
 
     const res = await GET(request(search));
 
     expect(res.status).toBe(303);
-    const location = res.headers.get("location") ?? "";
-    expect(location).toBe(
-      `/sign-in?next=${encodeURIComponent(`/api/auth/hub/authorize?${search}`)}`,
+    const { next, ref } = continuationOf(res);
+    expect(res.headers.get("location")).toBe(
+      `/sign-in?next=${encodeURIComponent(`${CONTINUE}/${ref}`)}`,
     );
+    expect(next).toBe(`${CONTINUE}/${ref}`);
+    expect(openContinuation(ref, mockSecret)).toBe(search);
+    expect(res.headers.get("cache-control")).toBe("no-store");
+    expect(res.headers.get("referrer-policy")).toBe("no-referrer");
     expect(mockCreateCode).not.toHaveBeenCalled();
   });
 
-  it("AC-6: the next value is a same-origin path the sign-in card keeps (resolveNextPath)", async () => {
+  it("#8146 AC-1(b): the next value is a same-origin path the sign-in card keeps (resolveNextPath) and a second decode cannot change", async () => {
     mockGetSession.mockResolvedValue(null);
 
     const res = await GET(request(query()));
 
-    const next =
-      new URL(res.headers.get("location") ?? "", HUB).searchParams.get(
-        "next",
-      ) ?? "";
-    expect(next.startsWith("/api/auth/hub/authorize?")).toBe(true);
+    const { next } = continuationOf(res);
+    expect(next.startsWith(`${CONTINUE}/`)).toBe(true);
     // Unchanged — not the fallback — so Better Auth is handed it as the callback
     // for Google and for the emailed link alike.
     expect(resolveNextPath(next, "/account")).toBe(next);
     expect(next).not.toMatch(/^https?:/);
+    // Better Auth decodes the callback a second time: nothing may change.
+    expect(next).toMatch(/^[A-Za-z0-9_/-]+$/);
+    expect(decodeURIComponent(decodeURIComponent(next))).toBe(next);
+  });
+
+  it("#8146 AC-1(b): the ref holds the canonical six-key query — a reversed query with an extra key opens to the same string, without it", async () => {
+    mockGetSession.mockResolvedValue(null);
+    const canonical = query();
+    const reversed = [...new URLSearchParams(canonical).entries()]
+      .reverse()
+      .map(([key, value]) => `${key}=${encodeURIComponent(value)}`)
+      .join("&");
+
+    const res = await GET(request(`${reversed}&extra=1`));
+
+    expect(res.status).toBe(303);
+    const opened = openContinuation(continuationOf(res).ref, mockSecret);
+    expect(opened).toBe(canonical);
+    expect(opened).not.toContain("extra");
+  });
+
+  it("#8146 AC-3(b): a redirect_uri whose ref would pass 4096 characters is a 400 with NO Location", async () => {
+    mockGetSession.mockResolvedValue(null);
+    const redirectUri = "https://spoke.example.com/".padEnd(2048, "/");
+
+    const res = await GET(request(query({ redirect_uri: redirectUri })));
+
+    expect(res.status).toBe(400);
+    expect(res.headers.get("location")).toBeNull();
+    expect(await res.json()).toEqual({ error: "invalid_request" });
+  });
+
+  it("#8146 AC-3(b): a 2048-character redirect_uri whose ref stays under the cap is a normal 303", async () => {
+    mockGetSession.mockResolvedValue(null);
+    const redirectUri = "https://spoke.example.com/".padEnd(2048, "a");
+
+    const res = await GET(request(query({ redirect_uri: redirectUri })));
+
+    expect(res.status).toBe(303);
+    expect(res.headers.get("location")).toMatch(/^\/sign-in\?next=/);
   });
 });
 

package/templates/apps/web/app/api/auth/hub/authorize/route.ts

@@ -13,11 +13,15 @@
  *       &code_challenge=…&code_challenge_method=S256
  *
  *   - a malformed query is a 400 and NEVER a redirect;
- *   - no Better Auth session: 303 to `/sign-in?next=<this path and query>` —
- *     a same-origin path, so `resolveNextPath` keeps it and the existing
- *     sign-in card hands it to Better Auth as the callback for Google and for
- *     the emailed link alike (the hub's own `magicLink` sends the link, and it
- *     returns through this step);
+ *   - no Better Auth session: the six validated keys are sealed into a short
+ *     ref and the answer is a 303 to `/sign-in?next=<the same-origin path
+ *     /api/auth/hub/continue/<ref>>` (#8146). `resolveNextPath` keeps that
+ *     path and the existing sign-in card hands it to Better Auth as the
+ *     callback for Google and for the emailed link alike; the continue route
+ *     then returns the visitor here. This route's own URL is NOT the callback:
+ *     Better Auth's magic-link verify decodes a callback twice, which turns the
+ *     encoded `redirect_uri` inside it into a URL its origin check refuses. A
+ *     ref longer than `CONTINUATION_REF_MAX` is a 400, never a redirect;
  *   - a session: the API mints a single-use code, and this route redirects to
  *     the REGISTERED redirect URI the API echoes back, with `code` and the
  *     same `state` — never to the query's own `redirect_uri` until the API has
@@ -40,7 +44,12 @@
 import { hubSignIn } from "@working-theory/api-client";
 import { hubAuthorizeQuerySchema } from "@working-theory/validation";
 
-import { auth } from "../../../../../auth";
+import { auth, resolveSecret } from "../../../../../auth";
+import {
+  CONTINUATION_REF_MAX,
+  CONTINUE_PATH,
+  mintContinuation,
+} from "../continuation";
 
 /** The six query keys, each read exactly once. */
 const QUERY_KEYS = [
@@ -106,7 +115,13 @@ export async function GET(request: Request): Promise<Response> {
 
   const session = await auth.api.getSession({ headers: request.headers });
   if (!session) {
-    const next = `${url.pathname}${url.search}`;
+    // Only the six validated keys, in QUERY_KEYS order: a ref carries nothing
+    // that did not pass the schema, and extra or reordered keys are dropped.
+    const canonical = new URLSearchParams();
+    for (const key of QUERY_KEYS) canonical.set(key, query[key]);
+    const ref = mintContinuation(canonical.toString(), resolveSecret());
+    if (ref.length > CONTINUATION_REF_MAX) return json(400, "invalid_request");
+    const next = `${CONTINUE_PATH}/${ref}`;
     return see(`/sign-in?next=${encodeURIComponent(next)}`);
   }
 

package/templates/apps/web/app/api/auth/hub/continuation.ts

@@ -0,0 +1,73 @@
+/**
+ * The hub's sign-in continuation (#8146, spec
+ * docs/specs/8146-email-link-sign-in-from-spec.md D2, D3).
+ *
+ * Better Auth's magic-link verify decodes `callbackURL` a second time, so a
+ * callback that holds an encoded `redirect_uri` is refused as
+ * INVALID_CALLBACK_URL. The authorize step therefore does not hand the sign-in
+ * page its own URL. It seals the validated authorize query into a short,
+ * opaque ref and hands over the same-origin path `/api/auth/hub/continue/<ref>`
+ * instead. A base64url string has no `%`, `?`, `&`, `=` or `:`, so no number of
+ * decodes changes it.
+ *
+ * Sealed (AES-256-GCM, key derived from the caller's secret under its own
+ * purpose), with its expiry inside. The ref is opaque but is NOT a secret: it
+ * carries what the cleartext `next` carried before (spec § 9 SEC-8146-1).
+ * Nothing here logs a ref.
+ */
+import { seal, unseal } from "../../../../lib/hub-session/seal";
+
+/** The same-origin path a ref is appended to. */
+export const CONTINUE_PATH = "/api/auth/hub/continue";
+
+/** The longest ref the authorize step will mint, and the continue route open. */
+export const CONTINUATION_REF_MAX = 4096;
+
+/**
+ * 600 s, matching the spoke's flow cookie: a longer life is useless (the spoke
+ * refuses the callback once its flow expires) and it covers the 300 s emailed
+ * link plus time on the sign-in page.
+ */
+export const CONTINUATION_TTL_SECONDS = 600;
+
+/** A fixed name: a value sealed for a cookie never opens here, nor the reverse. */
+const AAD = "hub-continue";
+
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+
+/** `search` (the canonical authorize query, no leading `?`) as a sealed ref. */
+export function mintContinuation(
+  search: string,
+  secret: string,
+  now: number = Date.now(),
+): string {
+  return seal(
+    { v: 1, q: search, exp: now + CONTINUATION_TTL_SECONDS * 1000 },
+    secret,
+    "continue",
+    AAD,
+  );
+}
+
+/**
+ * The authorize query a ref holds, or `null` when the ref is too long, is not
+ * base64url, does not open, is not the expected shape, or has expired.
+ *
+ * The query is re-serialized through `URLSearchParams`: for what
+ * `mintContinuation` wrote that is the same string, and for a `q` forged under
+ * a known secret it percent-encodes CR/LF so a `Location` can never be split
+ * and never throws (spec § 9 SEC-8146-7).
+ */
+export function openContinuation(
+  ref: string,
+  secret: string,
+  now: number = Date.now(),
+): string | null {
+  if (ref.length > CONTINUATION_REF_MAX || !BASE64URL.test(ref)) return null;
+  const value = unseal(ref, secret, "continue", AAD);
+  if (typeof value !== "object" || value === null) return null;
+  const { v, q, exp } = value as Record<string, unknown>;
+  if (v !== 1 || typeof q !== "string" || q === "") return null;
+  if (typeof exp !== "number" || exp <= now) return null;
+  return new URLSearchParams(q).toString();
+}