create-ailk 0.18.0 → 0.19.1

package/templates/apps/web/app/[locale]/(authed)/account/notifications/page.tsx

@@ -0,0 +1,57 @@
+/**
+ * /[locale]/account/notifications — User settings › Notifications (#8339
+ * D8, NEW).
+ *
+ * RSC, outside the account layout's SignedInShell (#8430), in the member's
+ * four-tab settings frame (D7) — standalone, the Admin's shape. Holds the former Privacy
+ * section's cookie-settings link, moved here verbatim from General (#8339
+ * C6) — for now; notification preferences are a later unit's scope.
+ */
+
+import { AccountSettingsFrame, AccountSettingsPane } from "@working-theory/templates/account";
+import { localeHref } from "@working-theory/ui";
+import { Link } from "@working-theory/ui/primitives";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { accountSession } from "../account-data";
+import { memberSettingsFrame, type Translate } from "../settings-frame";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "account" });
+  return { title: t("settings.notifications.title"), description: t("settings.privacy.lead") };
+}
+
+export default async function AccountNotificationsPage({ params }: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "account" });
+  const session = await accountSession(locale);
+  const frame = memberSettingsFrame(locale, t as unknown as Translate, "notifications");
+  const name = session?.ctx.user.name || session?.ctx.user.email || "";
+
+  return (
+    <AccountSettingsFrame {...frame} name={name}>
+      <AccountSettingsPane
+        id="account-settings-notifications"
+        title={t("settings.notifications.title")}
+        lead={t("settings.privacy.lead")}
+      >
+        <div>
+          <Link
+            href={localeHref(locale, "/privacy#cookie-settings")}
+            className="inline-flex min-h-6 items-center"
+            data-testid="account-cookie-settings"
+          >
+            {t("settings.privacy.cookies")}
+          </Link>
+        </div>
+      </AccountSettingsPane>
+    </AccountSettingsFrame>
+  );
+}

package/templates/apps/web/app/[locale]/(authed)/account/page.tsx

@@ -1,19 +1,18 @@
 /**
  * /[locale]/account — the base account area's Inbox (#7430, spec 7423 U4 ·
- * D6a, D9, D12; DESIGN.md §5.4).
+ * D6a, D9, D12; #8231 D3; DESIGN.md §5.4).
  *
  * RSC, rendered inside the account layout's SignedInShell. One filtered
- * list: the D6a tabs Recents · Suggested · Scheduled · All, each with a
- * count, Recents selected, through the shared `InboxList`
- * (`@working-theory/templates/account`):
+ * list: the tabs All · Purchases · Scheduled, each with a count, All
+ * selected, through the shared `InboxList` (`@working-theory/templates/account`):
  *
- *   - Recents — the kinds whose section is `updates` (the base `result` and
- *     `purchase`), newest first.
- *   - Suggested — nothing in the base area; no contribution section maps
- *     here yet (a module that proposes things fills it).
- *   - Scheduled — the kinds whose section is `upcoming` (the old Upcoming);
- *     none in the base area.
- *   - All — every row above, newest first.
+ *   - All — every loaded row, newest first. The kinds in `updates` or
+ *     `needs-you` (`result`, `piece`, `message`) show here only.
+ *   - Purchases — the kinds whose section is `purchases` (the `purchase`
+ *     kind, and any a module adds), newest first.
+ *   - Scheduled — the kinds whose section is `upcoming` (`appointment`):
+ *     first the items still upcoming, soonest first (no time last), then the
+ *     rest, newest first. Each kind's own read decides which is upcoming.
  *
  * What needs the person is never an Inbox row: `email-unverified`,
  * `payment-due` and "Add your name" are For-you items (D9 as amended). From
@@ -33,16 +32,24 @@
  * D12 — any read that fails (a kind or a For-you source) renders an error
  * row with Retry above the list; the list then holds what DID load, never a
  * silently empty Inbox.
+ *
+ * #8233 D4 — New sits in the h1's header row (and, below `md`, in the
+ * frame's phone top bar): its rows are `new-popups.tsx`'s `newActions` — the
+ * `accountNewActions` of `lib/account-config.ts` with their popups bound —
+ * whose `available` read resolved `true`, each opening its popup over the
+ * Inbox. None offered (a Free build) → no New at all. A read that rejected
+ * drops its row and shows the error row too — a failed read is never silent.
  */
 
 import {
   ForYouPanel,
   InboxList,
   PhoneTabPanel,
+  type AccountContext,
   type InboxListRow,
 } from "@working-theory/templates/account";
 import { Heading, Text } from "@working-theory/ui/primitives";
-import { ClipboardList, Receipt, type LucideProps } from "lucide-react";
+import { CalendarClock, ClipboardList, Receipt, type LucideProps } from "lucide-react";
 import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import type { ComponentType, ReactElement } from "react";
@@ -52,10 +59,13 @@ import {
   inboxItemHref,
   loadForYou,
   loadInboxItems,
+  logReadFailure,
   type LoadedInboxItem,
 } from "./account-data";
 import { ErrorRow } from "./error-row";
 import { ACCOUNT_PERSIST_KEY, forYouLabels } from "./for-you-labels";
+import { NewMenu, type NewMenuAction } from "./new-menu";
+import { newActions } from "./new-popups";
 
 interface Props {
   params: Promise<{ locale: string }>;
@@ -71,8 +81,37 @@ export async function generateMetadata({ params }: Props): Promise<Metadata> {
 const KIND_ICON: Record<string, ComponentType<LucideProps>> = {
   result: ClipboardList,
   purchase: Receipt,
+  appointment: CalendarClock,
 };
 
+/** Soonest first; an item with no time sorts last. */
+function soonestFirst(a: LoadedInboxItem, b: LoadedInboxItem): number {
+  if (a.item.at === undefined) return b.item.at === undefined ? 0 : 1;
+  if (b.item.at === undefined) return -1;
+  return Date.parse(a.item.at) - Date.parse(b.item.at);
+}
+
+/** The New actions this caller is offered; a rejected read drops its row and sets `failed`. */
+async function loadNewActions(
+  ctx: AccountContext,
+): Promise<{ actions: NewMenuAction[]; failed: boolean }> {
+  const settled = await Promise.allSettled(newActions.map((action) => action.available(ctx)));
+  const actions: NewMenuAction[] = [];
+  settled.forEach((result, i) => {
+    const action = newActions[i]!;
+    if (result.status === "rejected") logReadFailure(`new:${action.id}`, result.reason);
+    else if (result.value)
+      actions.push({ id: action.id, label: ctx.t(action.label), popup: action.renderPopup(ctx) });
+  });
+  return { actions, failed: settled.some((result) => result.status === "rejected") };
+}
+
+/** Upcoming items first, soonest first; then the rest, as loaded (newest first). */
+function scheduledOrder(rows: readonly LoadedInboxItem[]): LoadedInboxItem[] {
+  const upcoming = rows.filter(({ item }) => item.upcoming === true).sort(soonestFirst);
+  return [...upcoming, ...rows.filter(({ item }) => item.upcoming !== true)];
+}
+
 export default async function AccountInboxPage({ params }: Props): Promise<ReactElement> {
   const { locale } = await params;
   const t = await getTranslations({ locale, namespace: "account" });
@@ -80,9 +119,17 @@ export default async function AccountInboxPage({ params }: Props): Promise<React
 
   // The contract's translator, for keys that are data (a kind's `label`).
   const translate = session?.ctx.t ?? ((key: string): string => key);
-  const [inbox, forYou] = session
-    ? await Promise.all([loadInboxItems(session.ctx), loadForYou(locale)])
-    : [{ items: [], failed: false }, { items: [], failed: false, now: "" }];
+  const [inbox, forYou, newMenu] = session
+    ? await Promise.all([
+        loadInboxItems(session.ctx),
+        loadForYou(locale),
+        loadNewActions(session.ctx),
+      ])
+    : [
+        { items: [], failed: false },
+        { items: [], failed: false, now: "" },
+        { actions: [], failed: false },
+      ];
 
   const dateFormat = new Intl.DateTimeFormat(locale, {
     month: "short",
@@ -101,19 +148,27 @@ export default async function AccountInboxPage({ params }: Props): Promise<React
     };
   };
 
-  const recents = inbox.items.filter(({ kind }) => kind.section === "updates").map(toRow);
-  const scheduled = inbox.items.filter(({ kind }) => kind.section === "upcoming").map(toRow);
   const all = inbox.items.map(toRow);
-  const failed = inbox.failed || forYou.failed;
+  const purchases = inbox.items.filter(({ kind }) => kind.section === "purchases").map(toRow);
+  const scheduled = scheduledOrder(
+    inbox.items.filter(({ kind }) => kind.section === "upcoming"),
+  ).map(toRow);
+  const failed = inbox.failed || forYou.failed || newMenu.failed;
 
   return (
     // The phone's top bar already clears the canvas — no top inset there.
     <div className="max-w-3xl py-8 max-md:pt-0" data-testid="account-inbox">
       {/* The page's one h1, on both phone tabs; visually hidden on the phone,
-          which has no large title (§5.15). */}
-      <Heading level={1} visual={2} className="max-md:sr-only">
-        {t("inbox.title")}
-      </Heading>
+          which has no large title (§5.15). New sits beside it (#8233 D4). */}
+      <div className="flex items-center justify-between gap-2">
+        <Heading level={1} visual={2} className="max-md:sr-only">
+          {t("inbox.title")}
+        </Heading>
+        <NewMenu
+          actions={newMenu.actions}
+          labels={{ trigger: t("new.trigger"), close: t("new.close") }}
+        />
+      </div>
       <PhoneTabPanel tabs={["inbox"]} desktop data-testid="inbox-panel-inbox">
         <Text as="p" variant="body-sm" tone="muted" className="mt-block-tight hidden md:block">
           {t("inbox.lead")}
@@ -129,17 +184,21 @@ export default async function AccountInboxPage({ params }: Props): Promise<React
 
         <InboxList
           tabs={[
-            { id: "recents", label: t("inbox.tabs.recents"), count: recents.length, rows: recents },
-            { id: "suggested", label: t("inbox.tabs.suggested"), count: 0, rows: [] },
+            { id: "all", label: t("inbox.tabs.all"), count: all.length, rows: all },
+            {
+              id: "purchases",
+              label: t("inbox.tabs.purchases"),
+              count: purchases.length,
+              rows: purchases,
+            },
             {
               id: "scheduled",
               label: t("inbox.tabs.scheduled"),
               count: scheduled.length,
               rows: scheduled,
             },
-            { id: "all", label: t("inbox.tabs.all"), count: all.length, rows: all },
           ]}
-          defaultTab="recents"
+          defaultTab="all"
           {...(failed ? {} : { emptyLine: t("inbox.empty") })}
         />
       </PhoneTabPanel>

package/templates/apps/web/app/[locale]/(authed)/account/profile-actions.ts

@@ -0,0 +1,116 @@
+"use server";
+
+/**
+ * account/profile-actions.ts — User settings › General's two member writes
+ * (#8232, spec docs/specs/8232-member-settings-account-general-and-spec.md
+ * D6; the writes are #8170's).
+ *
+ *   - `saveProfile` — the member's name and photo, `member.updateProfile`
+ *     (`PATCH /v1/member/profile`). On a spoke the hub-session cookie is then
+ *     re-sealed from the hub's `/me` (`resealHubSession`, D11), so the new
+ *     name shows on the next render.
+ *   - `requestAccountDeletion` — `member.requestDeletion`
+ *     (`POST /v1/member/deletion-request`). The API files it with the
+ *     deployment that holds the account (8170 D9) and answers which operator
+ *     it went to, so nothing here tests the topology.
+ *
+ * Both send `forwardedCookieInit()`'s init: on a single site the session
+ * cookie plus the request's `Origin`, which `apps/api`'s cookie CSRF check
+ * needs; on a hub-mode spoke the hub credential. Neither takes an identity
+ * argument — who comes from the forwarded credential alone (8170 D1).
+ *
+ * Not a `*.actions.ts` file and no `*Action`-suffixed export: these writes
+ * have no MCP twin by decision (8170's header), and apps/mcp's parity test
+ * reads that suffix. `resealHubSession` is imported by its own path, never
+ * through `lib/hub-session/index.ts`: `sync-routes` never overwrites a
+ * scaffold's existing `index.ts`, so an import through it would not compile
+ * there (D13). Logs carry a status or `err.name` only — never a name, a
+ * link, an email or a credential.
+ */
+
+import { member } from "@working-theory/api-client";
+
+import { resealHubSession } from "../../../../lib/hub-session/reseal";
+import { forwardedCookieInit } from "../../../../lib/server-api";
+
+/** PII-safe error identity for logs (the `checkout.actions.ts` idiom: `err.name` only). */
+function errorName(err: unknown): string {
+  return err instanceof Error ? err.name : "unknown";
+}
+
+/** The `error.code` of a member write's refusal body, when it has one. */
+function errorCode(body: unknown): string | null {
+  if (typeof body !== "object" || body === null) return null;
+  const error = (body as { error?: unknown }).error;
+  if (typeof error !== "object" || error === null) return null;
+  const code = (error as { code?: unknown }).code;
+  return typeof code === "string" ? code : null;
+}
+
+export type SaveProfileResult =
+  | { ok: true; name: string | null; image: string | null }
+  | { ok: false; reason: "required" | "photo" | "unverified" | "unavailable" | "failed" };
+
+/**
+ * Saves the member's name, and their photo when `image` is present:
+ * `null` (or a blank link) clears it, and an absent key leaves it as it is.
+ */
+export async function saveProfile(input: {
+  name: string;
+  image?: string | null;
+}): Promise<SaveProfileResult> {
+  // Action input is untrusted: a hand-built call may send anything.
+  const { name: rawName, image } = (typeof input === "object" && input !== null ? input : {}) as {
+    name?: unknown;
+    image?: unknown;
+  };
+  const name = typeof rawName === "string" ? rawName.trim() : "";
+  if (!name) return { ok: false, reason: "required" };
+  // Anything but a string or null is refused, never read as "clear the photo".
+  if (image !== undefined && image !== null && typeof image !== "string") {
+    return { ok: false, reason: "photo" };
+  }
+  const body = image === undefined ? { name } : { name, image: image?.trim() || null };
+
+  try {
+    const res = await member.updateProfile(body, await forwardedCookieInit());
+    if (res.ok) {
+      if ((await resealHubSession()) === "failed") {
+        console.error("[profile-actions] saveProfile reseal=failed");
+      }
+      return { ok: true, name: res.body.name, image: res.body.image };
+    }
+    console.error(`[profile-actions] saveProfile status=${res.status}`);
+    if (res.status === 400 && errorCode(res.body) === "link_not_https") {
+      return { ok: false, reason: "photo" };
+    }
+    if (res.status === 403) return { ok: false, reason: "unverified" };
+    if (res.status === 404 || res.status === 503) return { ok: false, reason: "unavailable" };
+    return { ok: false, reason: "failed" };
+  } catch (err) {
+    console.error(`[profile-actions] saveProfile errName=${errorName(err)}`);
+    return { ok: false, reason: "failed" };
+  }
+}
+
+export type AccountDeletionResult =
+  | { ok: true; sentTo: "site-operator" | "hub-operator" }
+  | { ok: false; reason: "unverified" | "unavailable" | "failed" };
+
+/**
+ * Asks the operator who holds the account to delete it. The body is empty,
+ * so the API's own subject and message go to the operator.
+ */
+export async function requestAccountDeletion(): Promise<AccountDeletionResult> {
+  try {
+    const res = await member.requestDeletion({}, await forwardedCookieInit());
+    if (res.ok) return { ok: true, sentTo: res.body.sentTo };
+    console.error(`[profile-actions] requestAccountDeletion status=${res.status}`);
+    if (res.status === 403) return { ok: false, reason: "unverified" };
+    if (res.status === 404 || res.status === 503) return { ok: false, reason: "unavailable" };
+    return { ok: false, reason: "failed" };
+  } catch (err) {
+    console.error(`[profile-actions] requestAccountDeletion errName=${errorName(err)}`);
+    return { ok: false, reason: "failed" };
+  }
+}

package/templates/apps/web/app/[locale]/(authed)/account/security/page.tsx

@@ -0,0 +1,132 @@
+/**
+ * /[locale]/account/security — User settings › Security (#8339 D8; #8431 D3).
+ *
+ * RSC, outside the account layout's SignedInShell (#8430), in the member's
+ * four-tab settings frame (D7) — standalone, the Admin's shape. It shows how
+ * this person signs in, then Log out, through the shared `SecuritySettings`
+ * (`security-panel.tsx` supplies its actions):
+ *
+ *   - a site or hub that can email a password link: the Password row, set
+ *     or changed by an emailed link to the person's own address;
+ *   - any other site: one sentence naming the deployment's methods;
+ *   - a spoke that signs in through its hub: "Your sign-in is managed at
+ *     <hub>", with a link to the hub's own Security page.
+ *
+ * `security-source.ts` picks the variant; this page turns it into text.
+ */
+
+import { AccountSettingsFrame, AccountSettingsPane } from "@working-theory/templates/account";
+import { localeHref } from "@working-theory/ui";
+import type { Metadata } from "next";
+import { headers } from "next/headers";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { SIGN_IN_PATH, SIGN_OUT_ENDPOINT } from "../../../../../lib/topology.generated";
+import { accountSession } from "../account-data";
+import { ErrorRow } from "../error-row";
+import { memberSettingsFrame, type Translate } from "../settings-frame";
+import type { SignInMethodId } from "../sign-in-method";
+
+import { SecurityPanel, type SecurityPanelVariant } from "./security-panel";
+import { securitySource } from "./security-source";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "account" });
+  return { title: t("settings.security.title"), description: t("settings.signIn.lead") };
+}
+
+/** Each sign-in method's phrase in the sentence (C5). */
+const METHOD_KEYS = {
+  google: "settings.security.methods.google",
+  github: "settings.security.methods.github",
+  "magic-link": "settings.security.methods.magicLink",
+  email: "settings.security.methods.password",
+} as const satisfies Record<SignInMethodId, string>;
+
+export default async function AccountSecurityPage({ params }: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "account" });
+  const session = await accountSession(locale);
+  const frame = memberSettingsFrame(locale, t as unknown as Translate, "security");
+  const email = session?.ctx.user.email ?? "";
+  const name = session?.ctx.user.name || email;
+
+  const source = await securitySource(await headers());
+
+  let variant: SecurityPanelVariant | null;
+  if (source.kind === "password") {
+    variant = source.hasPassword === null ? null : { kind: "password", hasPassword: source.hasPassword };
+  } else if (source.kind === "sentence") {
+    const methods = source.methods.map((id) => t(METHOD_KEYS[id], { email }));
+    variant = {
+      kind: "sentence",
+      text:
+        methods.length > 0
+          ? t("settings.security.signsInWith", {
+              methods: new Intl.ListFormat(locale, { type: "disjunction" }).format(methods),
+            })
+          : t("settings.security.signedInAs", { email }),
+    };
+  } else {
+    variant = {
+      kind: "hub",
+      text:
+        source.hubHost !== null
+          ? t("settings.security.managedAt", { hub: source.hubHost })
+          : t("settings.security.managedUnnamed"),
+      link:
+        source.hubHost !== null && source.hubOrigin !== null
+          ? {
+              href: new URL("/account/security", source.hubOrigin).href,
+              label: t("settings.security.manageOnHub", { hub: source.hubHost }),
+            }
+          : null,
+    };
+  }
+
+  return (
+    <AccountSettingsFrame {...frame} name={name}>
+      <AccountSettingsPane
+        id="account-settings-security"
+        title={t("settings.security.title")}
+        lead={t("settings.signIn.lead")}
+      >
+        <SecurityPanel
+          variant={variant}
+          failed={
+            <ErrorRow message={t("settings.security.passwordUnavailable")} retryLabel={t("inbox.retry")} />
+          }
+          email={email}
+          // Absolute and same-origin, built here from BETTER_AUTH_URL — the
+          // `(auth)/forgot-password/page.tsx` derivation.
+          resetUrl={`${process.env.BETTER_AUTH_URL ?? ""}${localeHref(locale, "/reset-password")}`}
+          signOutEndpoint={SIGN_OUT_ENDPOINT}
+          signInHref={localeHref(locale, SIGN_IN_PATH ?? "/")}
+          labels={{
+            methodsHeading: t("settings.security.methodsHeading"),
+            passwordLabel: t("settings.security.passwordLabel"),
+            passwordSet: t("settings.security.passwordSet"),
+            passwordNotSet: t("settings.security.passwordNotSet"),
+            setHint: t("settings.security.setHint"),
+            changeHint: t("settings.security.changeHint"),
+            setNote: t("settings.security.setNote", { email }),
+            changeNote: t("settings.security.changeNote", { email }),
+            setButton: t("settings.security.setButton"),
+            changeButton: t("settings.security.changeButton"),
+            sending: t("settings.security.sending"),
+            sent: t("settings.security.sent"),
+            sendFailed: t("settings.security.sendFailed"),
+            logOut: t("settings.security.logOut"),
+            logOutFailed: t("settings.security.logOutFailed"),
+          }}
+        />
+      </AccountSettingsPane>
+    </AccountSettingsFrame>
+  );
+}

package/templates/apps/web/app/[locale]/(authed)/account/security/security-panel.tsx

@@ -0,0 +1,102 @@
+"use client"; // Better Auth's client calls (requestPasswordReset, signOut) and router navigation need the browser
+
+/**
+ * SecurityPanel — the member's adapter over `SecuritySettings` (#8431 D3).
+ *
+ * The page (RSC) resolves the variant, the strings, the person's own address,
+ * the reset link's absolute `redirectTo` and where Log out lands; this island
+ * supplies the two actions:
+ *
+ *   - the Password row's request: Better Auth's `requestPasswordReset` for
+ *     the person's OWN address, with the server-built `redirectTo` (never one
+ *     derived from `window.location` — `forgot-password-card.tsx`'s rule);
+ *   - Log out: the spoke's same-origin sign-out endpoint when the page passes
+ *     one, else Better Auth's `signOut`. Only a log-out that succeeded
+ *     navigates (the `SignOutTrigger` rule).
+ *
+ * Its `authClient` is its own module-scope `createAuthClient()`, the
+ * `account-frame.tsx` idiom — never imported from `(auth)/`, a tree a spoke
+ * drops.
+ */
+
+import {
+  SecuritySettings,
+  type SecuritySettingsLabels,
+  type SecuritySignIn,
+} from "@working-theory/templates/account";
+import { createAuthClient } from "better-auth/react";
+import { useRouter } from "next/navigation";
+import type { ReactElement, ReactNode } from "react";
+
+const authClient = createAuthClient();
+
+/** The variant as the page resolved it — serializable, no functions. */
+export type SecurityPanelVariant =
+  | { kind: "password"; hasPassword: boolean }
+  | { kind: "sentence"; text: string }
+  | { kind: "hub"; text: string; link: { href: string; label: string } | null };
+
+export interface SecurityPanelProps {
+  /** `null`: the accounts read failed; `failed` renders in its place. */
+  variant: SecurityPanelVariant | null;
+  failed?: ReactNode;
+  /** The session's own address — the only one a link is ever requested for. */
+  email: string;
+  /** The absolute reset page the emailed link returns to. */
+  resetUrl: string;
+  /** A spoke's same-origin sign-out route; `null` signs out through Better Auth. */
+  signOutEndpoint: string | null;
+  /** The site's sign-in page, where Log out lands. */
+  signInHref: string;
+  labels: SecuritySettingsLabels;
+}
+
+export function SecurityPanel({
+  variant,
+  failed,
+  email,
+  resetUrl,
+  signOutEndpoint,
+  signInHref,
+  labels,
+}: SecurityPanelProps): ReactElement {
+  const router = useRouter();
+
+  async function requestLink(): Promise<boolean> {
+    // A refusal (the rate limit, the method off) resolves with `{ error }`; a
+    // network failure rejects. Both read as not sent.
+    return authClient.requestPasswordReset({ email, redirectTo: resetUrl }).then(
+      (res) => !res?.error,
+      () => false,
+    );
+  }
+
+  async function logOut(): Promise<boolean> {
+    let ok: boolean;
+    try {
+      if (signOutEndpoint !== null) {
+        const res = await fetch(signOutEndpoint, { method: "POST", credentials: "same-origin" });
+        ok = res.ok;
+      } else {
+        const res = await authClient.signOut();
+        ok = !res?.error;
+      }
+    } catch {
+      ok = false;
+    }
+    // A failed log-out leaves the person signed in: navigate nowhere.
+    if (!ok) return false;
+    router.push(signInHref);
+    router.refresh();
+    return true;
+  }
+
+  const signIn: SecuritySignIn | null =
+    variant === null
+      ? null
+      : variant.kind === "password"
+        ? { kind: "password", hasPassword: variant.hasPassword, onRequestLink: requestLink }
+        : variant;
+
+  return <SecuritySettings signIn={signIn} failed={failed} onLogOut={logOut} labels={labels} />;
+}

package/templates/apps/web/app/[locale]/(authed)/account/security/security-source.ts

@@ -0,0 +1,62 @@
+/**
+ * account/security/security-source.ts (server code) — which sign-in variant
+ * the member's Security tab shows (#8431 D2, spec
+ * docs/specs/8431-account-security-tab-human-sign-spec.md).
+ *
+ *   - hub      — a spoke that signs in through its hub: the hub's host and
+ *                origin, from `signInMethod()` and `hubSessionConfig()`.
+ *   - password — a site or hub that can email a password link
+ *                (`resetSendConfigured()`, C1): whether this person has a
+ *                password, from the session's own accounts.
+ *   - sentence — any other site: the deployment's configured methods.
+ *
+ * It tests no topology constant and imports nothing that loads `auth.ts`:
+ * `sign-in-method.ts` and the generated seam stay the account tree's seams
+ * (a hub-sign-in spoke drops `auth.ts`, and `spokeExclusions` refuses any
+ * surviving account file that reaches it).
+ *
+ * The seam is read as a namespace, never by a named import: a site whose
+ * seam was rendered before #8431 lacks the accounts reader (D2a), and a
+ * Security route `sync-routes` copies into it must still compile. There it
+ * shows the sentence — a retry cannot fix a stale seam (D2b).
+ */
+
+import { resetSendConfigured } from "../../../../../lib/auth-env";
+import { hubSessionConfig } from "../../../../../lib/hub-session/config";
+import * as seam from "../../../../../lib/topology.generated";
+import { logReadFailure } from "../account-data";
+import { signInMethod, type SignInMethodId } from "../sign-in-method";
+
+export type SecuritySource =
+  /** `hasPassword: null` — the accounts read failed. */
+  | { kind: "password"; hasPassword: boolean | null }
+  | { kind: "sentence"; methods: SignInMethodId[] }
+  | { kind: "hub"; hubHost: string | null; hubOrigin: string | null };
+
+type OwnAccountsReader = (headers: Headers) => Promise<ReadonlyArray<{ providerId: string }> | null>;
+
+/** The seam's accounts reader (D2a), or `null` on a seam rendered before it existed. */
+function ownAccountsReader(): OwnAccountsReader | null {
+  const reader: unknown = Reflect.get(seam, "readOwnAccounts");
+  return typeof reader === "function" ? (reader as OwnAccountsReader) : null;
+}
+
+export async function securitySource(headers: Headers): Promise<SecuritySource> {
+  const signIn = signInMethod();
+  if (signIn.kind === "hub") {
+    return { kind: "hub", hubHost: signIn.hubHost, hubOrigin: hubSessionConfig()?.hubOrigin ?? null };
+  }
+  if (!resetSendConfigured()) return { kind: "sentence", methods: signIn.methods };
+
+  const read = ownAccountsReader();
+  if (read === null) return { kind: "sentence", methods: signIn.methods };
+  try {
+    const accounts = await read(headers);
+    // `null` is a topology with no local accounts, which never reaches here.
+    if (accounts === null) return { kind: "password", hasPassword: null };
+    return { kind: "password", hasPassword: accounts.some((a) => a.providerId === "credential") };
+  } catch (err) {
+    logReadFailure("security-password", err);
+    return { kind: "password", hasPassword: null };
+  }
+}