create-ailk 0.19.0 → 0.19.1

package/templates/apps/web/app/[locale]/(authed)/account/general/contact-actions.ts

@@ -0,0 +1,81 @@
+"use server";
+
+/**
+ * general/contact-actions.ts — User settings › General's contact-details write
+ * (#8435, spec docs/specs/8435-contact-details-on-the-client-spec.md D13; the
+ * route is `PATCH /v1/member/profile/contact`).
+ *
+ * `saveContact` replaces the member's contact details on THIS site —
+ * `member.updateContact`, never the hub account's name and photo
+ * (`profile-actions.ts`'s `saveProfile` is that) and never another site's
+ * record. It sends `forwardedCookieInit()`'s init: on a single site the session
+ * cookie plus the request's `Origin`, which `apps/api`'s cookie CSRF check
+ * needs; on a hub-mode spoke the hub credential. It takes no identity
+ * argument — who comes from the forwarded credential alone.
+ *
+ * It answers `{ ok: true }` or a refusal `reason` the form maps to its own
+ * line: `telephone` (a number that is not E.164, `400 telephone_invalid`),
+ * `invalid` (any other refused body), `unverified` (`403`), `unavailable`
+ * (`404`, `503`, or `409 contact_unavailable` — a Person of that email held by
+ * another account), else `failed`. Logs carry a status or `err.name` only —
+ * never a name, a number, an address or an email.
+ *
+ * Not a `*.actions.ts` file and no `*Action`-suffixed export: the write has no
+ * MCP twin by decision (8435 D12), and apps/mcp's parity test reads that
+ * suffix.
+ */
+
+import { member } from "@working-theory/api-client";
+
+import { forwardedCookieInit } from "../../../../../lib/server-api";
+
+/** PII-safe error identity for logs (the `profile-actions.ts` idiom: `err.name` only). */
+function errorName(err: unknown): string {
+  return err instanceof Error ? err.name : "unknown";
+}
+
+/** The `error.code` of a member write's refusal body, when it has one. */
+function errorCode(body: unknown): string | null {
+  if (typeof body !== "object" || body === null) return null;
+  const error = (body as { error?: unknown }).error;
+  if (typeof error !== "object" || error === null) return null;
+  const code = (error as { code?: unknown }).code;
+  return typeof code === "string" ? code : null;
+}
+
+export type SaveContactResult =
+  | { ok: true }
+  | {
+      ok: false;
+      reason: "telephone" | "invalid" | "unverified" | "unavailable" | "failed";
+    };
+
+export async function saveContact(
+  input: Parameters<typeof member.updateContact>[0],
+): Promise<SaveContactResult> {
+  // Action input is untrusted: a hand-built call may send anything, and the
+  // API's own schema is the validator — a non-object is refused before any call.
+  if (typeof input !== "object" || input === null)
+    return { ok: false, reason: "invalid" };
+
+  try {
+    const res = await member.updateContact(input, await forwardedCookieInit());
+    if (res.ok) return { ok: true };
+    console.error(`[contact-actions] saveContact status=${res.status}`);
+    if (res.status === 400) {
+      return {
+        ok: false,
+        reason:
+          errorCode(res.body) === "telephone_invalid" ? "telephone" : "invalid",
+      };
+    }
+    if (res.status === 403) return { ok: false, reason: "unverified" };
+    if (res.status === 404 || res.status === 409 || res.status === 503) {
+      return { ok: false, reason: "unavailable" };
+    }
+    return { ok: false, reason: "failed" };
+  } catch (err) {
+    console.error(`[contact-actions] saveContact errName=${errorName(err)}`);
+    return { ok: false, reason: "failed" };
+  }
+}

package/templates/apps/web/app/[locale]/(authed)/account/general/page.tsx

@@ -2,12 +2,14 @@
  * /[locale]/account/general — User settings › General (#8339 D8; builds on
  * #8232 D2).
  *
- * RSC, inside the account layout's SignedInShell with the rail visible, in
- * the member's four-tab settings frame (D7). Renders the shared
+ * RSC, outside the account layout's SignedInShell (#8430), in the member's
+ * four-tab settings frame (D7) — standalone, the Admin's shape. Renders the shared
  * `AccountSettings` composition (@working-theory/templates/account, spec
  * 8339 D4) — the same General form the Admin renders — through the client
  * adapter `GeneralSettings` (`profile-form.tsx`). Below the form:
  *
+ *   - the contact details (`AccountContactDetails`, #8435 D13) — only on the
+ *     member path, seeded from `member.contact` and saved by `saveContact`;
  *   - Request account deletion (`DeletionRequest`, #8232 D5);
  *   - any section a module contributes (`accountSettingsSections`);
  *   - `BillingAnchor`, which forwards a `#billing` fragment to Billing.
@@ -19,9 +21,15 @@
  * `loadProfileSource` (D3), never a topology test here.
  */
 
-import { AccountSettingsFrame, AccountSettingsPane } from "@working-theory/templates/account";
+import { member } from "@working-theory/api-client";
+import {
+  AccountContactDetails,
+  AccountSettingsFrame,
+  AccountSettingsPane,
+  type AccountContact,
+} from "@working-theory/templates/account";
 import { localeHref } from "@working-theory/ui";
-import { Separator } from "@working-theory/ui/primitives";
+import { Separator, Text } from "@working-theory/ui/primitives";
 import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
@@ -32,6 +40,7 @@ import { siteThemeModeCount } from "../settings/theme-modes";
 import { memberSettingsFrame, SettingsSection, type Translate } from "../settings-frame";
 
 import { BillingAnchor } from "./billing-anchor";
+import { saveContact } from "./contact-actions";
 import { DeletionRequest } from "./deletion-request";
 import { GeneralSettings } from "./profile-form";
 import { loadProfileSource } from "./profile-source";
@@ -70,6 +79,19 @@ export default async function AccountGeneralPage({ params }: Props): Promise<Rea
   const { ctx } = session;
   const source = await loadProfileSource(ctx);
 
+  // #8435 D13 — the person's confirmed contact on this site. A failed read
+  // renders the section's "unavailable" line, never the form: a form seeded
+  // from nothing would offer to replace details it never showed.
+  let contactRead: { ok: true; contact: AccountContact | null } | { ok: false } | null = null;
+  if (source.via === "member") {
+    try {
+      const res = await member.contact(ctx.init);
+      contactRead = res.ok ? { ok: true, contact: res.body.contact } : { ok: false };
+    } catch {
+      contactRead = { ok: false };
+    }
+  }
+
   return (
     <GeneralSettings
       frame={memberSettingsFrame(locale, t as unknown as Translate, "general")}
@@ -102,6 +124,46 @@ export default async function AccountGeneralPage({ params }: Props): Promise<Rea
       }
       via={source.via}
     >
+      {contactRead ? (
+        <>
+          <Separator />
+          <div data-testid="account-contact-section">
+            {contactRead.ok ? (
+              <AccountContactDetails
+                contact={contactRead.contact}
+                onSave={saveContact}
+                labels={{
+                  title: t("settings.general.contact.title"),
+                  lead: t("settings.general.contact.lead"),
+                  givenName: t("settings.general.contact.givenName"),
+                  familyName: t("settings.general.contact.familyName"),
+                  telephone: t("settings.general.contact.telephone"),
+                  address: t("settings.general.contact.address"),
+                  companyName: t("settings.general.contact.companyName"),
+                  jobTitle: t("settings.general.contact.jobTitle"),
+                  save: t("settings.general.contact.save"),
+                  saving: t("settings.general.contact.saving"),
+                  saved: t("settings.general.contact.saved"),
+                  addressIncomplete: t("settings.general.contact.addressIncomplete"),
+                  errors: {
+                    telephone: t("settings.general.contact.errors.telephone"),
+                    invalid: t("settings.general.contact.errors.invalid"),
+                    unverified: t("settings.general.contact.errors.unverified"),
+                    unavailable: t("settings.general.contact.errors.unavailable"),
+                    failed: t("settings.general.contact.errors.failed"),
+                  },
+                }}
+              />
+            ) : (
+              <span data-testid="account-contact-unavailable">
+                <Text as="p" variant="body-sm" tone="muted">
+                  {t("settings.general.contact.unavailable")}
+                </Text>
+              </span>
+            )}
+          </div>
+        </>
+      ) : null}
       <Separator />
       <div data-testid="account-deletion">
         <DeletionRequest

package/templates/apps/web/app/[locale]/(authed)/account/layout.tsx

@@ -2,8 +2,9 @@
  * The account layout — the base account area's frame (#7430, spec 7423 U4 ·
  * D4, D13; DESIGN.md §2b).
  *
- * RSC. Every `/account` route renders inside `SignedInShell` (through the
- * client `AccountFrame`): the site's logo as the rail's top tile, linking
+ * RSC. Every `/account` route but the four Settings tabs renders inside
+ * `SignedInShell` (through the client `AccountFrame`; the tabs draw their own
+ * standalone settings frame, #8430): the site's logo as the rail's top tile, linking
  * home; the rail's rows — Inbox, a Library group holding Artifacts, then
  * Settings (#8231 D1); a footer of the avatar and ? alone;
  * the card avatar menu (name, then Settings and Log out); the ? help menu
@@ -16,6 +17,10 @@
  * area's own "Add your name" item (`loadForYou`, deduped per request with
  * the Inbox's phone For you tab); with no items there is no aside.
  *
+ * #8465 — `SIGN_OUT_ENDPOINT` (set only on a spoke that signs in through its
+ * hub) and `SIGN_IN_PATH` ride down as props; the client frame cannot import
+ * the generated seam, and the signed-in Nav reads it the same way.
+ *
  * The `(authed)` layout above owns the signed-out gate, so a missing session
  * here is a race (it expired between the two layouts): the page renders
  * unframed and degrades on its own.
@@ -26,11 +31,22 @@ import { getTranslations } from "next-intl/server";
 import type { ReactElement, ReactNode } from "react";
 
 import { siteLogo } from "../../../../lib/site-logo";
+import { SIGN_IN_PATH, SIGN_OUT_ENDPOINT } from "../../../../lib/topology.generated";
 
 import { accountSession, loadForYou } from "./account-data";
 import { AccountFrame } from "./account-frame";
 import { forYouLabels } from "./for-you-labels";
 
+/** The value when it parses as an https URL, else undefined: operator config is rendered as an href. */
+function httpsUrl(value: string | undefined): string | undefined {
+  if (!value) return undefined;
+  try {
+    return new URL(value).protocol === "https:" ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 interface Props {
   children: ReactNode;
   params: Promise<{ locale: string }>;
@@ -47,7 +63,7 @@ export default async function AccountLayout({
   const t = await getTranslations({ locale, namespace: "account" });
   const forYou = await loadForYou(locale);
   const { name, email } = session.ctx.user;
-  const helpCenterUrl = process.env.AILK_HELP_CENTER_URL;
+  const helpCenterUrl = httpsUrl(process.env.AILK_HELP_CENTER_URL);
 
   return (
     <AccountFrame
@@ -65,6 +81,12 @@ export default async function AccountLayout({
           : []),
       ]}
       forYou={{ items: forYou.items, now: forYou.now, labels: forYouLabels(session.ctx.t) }}
+      {...(SIGN_OUT_ENDPOINT
+        ? {
+            signOutEndpoint: SIGN_OUT_ENDPOINT,
+            signInHref: localeHref(locale, SIGN_IN_PATH ?? "/"),
+          }
+        : {})}
       labels={{
         home: t("frame.home"),
         inbox: t("frame.inbox"),
@@ -72,6 +94,7 @@ export default async function AccountLayout({
         settings: t("frame.settings"),
         library: t("frame.library"),
         artifacts: t("frame.artifacts"),
+        signOutFailed: t("frame.signOutFailed"),
         signOut: t("frame.signOut"),
         help: t("frame.help"),
         accountMenu: t("frame.accountMenu"),

package/templates/apps/web/app/[locale]/(authed)/account/notifications/page.tsx

@@ -2,8 +2,8 @@
  * /[locale]/account/notifications — User settings › Notifications (#8339
  * D8, NEW).
  *
- * RSC, inside the account layout's SignedInShell with the rail visible, in
- * the member's four-tab settings frame (D7). Holds the former Privacy
+ * RSC, outside the account layout's SignedInShell (#8430), in the member's
+ * four-tab settings frame (D7) — standalone, the Admin's shape. Holds the former Privacy
  * section's cookie-settings link, moved here verbatim from General (#8339
  * C6) — for now; notification preferences are a later unit's scope.
  */

package/templates/apps/web/app/[locale]/(authed)/account/security/page.tsx

@@ -1,23 +1,35 @@
 /**
- * /[locale]/account/security — User settings › Security (#8339 D8, NEW).
+ * /[locale]/account/security — User settings › Security (#8339 D8; #8431 D3).
  *
- * RSC, inside the account layout's SignedInShell with the rail visible, in
- * the member's four-tab settings frame (D7). Holds the former Sign-in
- * section's content, moved here verbatim from General (#8339 C6): how this
- * member signs in (`signInMethod()`, #8232 D7) — the hub line (named or
- * unnamed), the configured methods, or none.
+ * RSC, outside the account layout's SignedInShell (#8430), in the member's
+ * four-tab settings frame (D7) — standalone, the Admin's shape. It shows how
+ * this person signs in, then Log out, through the shared `SecuritySettings`
+ * (`security-panel.tsx` supplies its actions):
+ *
+ *   - a site or hub that can email a password link: the Password row, set
+ *     or changed by an emailed link to the person's own address;
+ *   - any other site: one sentence naming the deployment's methods;
+ *   - a spoke that signs in through its hub: "Your sign-in is managed at
+ *     <hub>", with a link to the hub's own Security page.
+ *
+ * `security-source.ts` picks the variant; this page turns it into text.
  */
 
 import { AccountSettingsFrame, AccountSettingsPane } from "@working-theory/templates/account";
-import { DescriptionList } from "@working-theory/ui/blocks";
-import { Text } from "@working-theory/ui/primitives";
+import { localeHref } from "@working-theory/ui";
 import type { Metadata } from "next";
+import { headers } from "next/headers";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
+import { SIGN_IN_PATH, SIGN_OUT_ENDPOINT } from "../../../../../lib/topology.generated";
 import { accountSession } from "../account-data";
+import { ErrorRow } from "../error-row";
 import { memberSettingsFrame, type Translate } from "../settings-frame";
-import { signInMethod, type SignInMethodId } from "../sign-in-method";
+import type { SignInMethodId } from "../sign-in-method";
+
+import { SecurityPanel, type SecurityPanelVariant } from "./security-panel";
+import { securitySource } from "./security-source";
 
 interface Props {
   params: Promise<{ locale: string }>;
@@ -29,12 +41,12 @@ export async function generateMetadata({ params }: Props): Promise<Metadata> {
   return { title: t("settings.security.title"), description: t("settings.signIn.lead") };
 }
 
-/** Each sign-in method's label key. */
+/** Each sign-in method's phrase in the sentence (C5). */
 const METHOD_KEYS = {
-  google: "settings.signIn.methods.google",
-  github: "settings.signIn.methods.github",
-  "magic-link": "settings.signIn.methods.magicLink",
-  email: "settings.signIn.methods.password",
+  google: "settings.security.methods.google",
+  github: "settings.security.methods.github",
+  "magic-link": "settings.security.methods.magicLink",
+  email: "settings.security.methods.password",
 } as const satisfies Record<SignInMethodId, string>;
 
 export default async function AccountSecurityPage({ params }: Props): Promise<ReactElement> {
@@ -42,9 +54,41 @@ export default async function AccountSecurityPage({ params }: Props): Promise<Re
   const t = await getTranslations({ locale, namespace: "account" });
   const session = await accountSession(locale);
   const frame = memberSettingsFrame(locale, t as unknown as Translate, "security");
-  const name = session?.ctx.user.name || session?.ctx.user.email || "";
+  const email = session?.ctx.user.email ?? "";
+  const name = session?.ctx.user.name || email;
+
+  const source = await securitySource(await headers());
 
-  const signIn = signInMethod();
+  let variant: SecurityPanelVariant | null;
+  if (source.kind === "password") {
+    variant = source.hasPassword === null ? null : { kind: "password", hasPassword: source.hasPassword };
+  } else if (source.kind === "sentence") {
+    const methods = source.methods.map((id) => t(METHOD_KEYS[id], { email }));
+    variant = {
+      kind: "sentence",
+      text:
+        methods.length > 0
+          ? t("settings.security.signsInWith", {
+              methods: new Intl.ListFormat(locale, { type: "disjunction" }).format(methods),
+            })
+          : t("settings.security.signedInAs", { email }),
+    };
+  } else {
+    variant = {
+      kind: "hub",
+      text:
+        source.hubHost !== null
+          ? t("settings.security.managedAt", { hub: source.hubHost })
+          : t("settings.security.managedUnnamed"),
+      link:
+        source.hubHost !== null && source.hubOrigin !== null
+          ? {
+              href: new URL("/account/security", source.hubOrigin).href,
+              label: t("settings.security.manageOnHub", { hub: source.hubHost }),
+            }
+          : null,
+    };
+  }
 
   return (
     <AccountSettingsFrame {...frame} name={name}>
@@ -53,27 +97,35 @@ export default async function AccountSecurityPage({ params }: Props): Promise<Re
         title={t("settings.security.title")}
         lead={t("settings.signIn.lead")}
       >
-        <div data-testid="account-signin-method">
-          {signIn.kind === "hub" ? (
-            <Text as="p" variant="body-sm" tone="muted">
-              {signIn.hubHost !== null
-                ? t("settings.signIn.viaHub", { hub: signIn.hubHost })
-                : t("settings.signIn.viaHubUnnamed")}
-            </Text>
-          ) : signIn.methods.length > 0 ? (
-            <DescriptionList
-              items={signIn.methods.map((id) => ({
-                label: t(METHOD_KEYS[id]),
-                value: t("settings.signIn.available"),
-                "data-testid": `account-signin-${id}`,
-              }))}
-            />
-          ) : (
-            <Text as="p" variant="body-sm" tone="muted">
-              {t("settings.signIn.none")}
-            </Text>
-          )}
-        </div>
+        <SecurityPanel
+          variant={variant}
+          failed={
+            <ErrorRow message={t("settings.security.passwordUnavailable")} retryLabel={t("inbox.retry")} />
+          }
+          email={email}
+          // Absolute and same-origin, built here from BETTER_AUTH_URL — the
+          // `(auth)/forgot-password/page.tsx` derivation.
+          resetUrl={`${process.env.BETTER_AUTH_URL ?? ""}${localeHref(locale, "/reset-password")}`}
+          signOutEndpoint={SIGN_OUT_ENDPOINT}
+          signInHref={localeHref(locale, SIGN_IN_PATH ?? "/")}
+          labels={{
+            methodsHeading: t("settings.security.methodsHeading"),
+            passwordLabel: t("settings.security.passwordLabel"),
+            passwordSet: t("settings.security.passwordSet"),
+            passwordNotSet: t("settings.security.passwordNotSet"),
+            setHint: t("settings.security.setHint"),
+            changeHint: t("settings.security.changeHint"),
+            setNote: t("settings.security.setNote", { email }),
+            changeNote: t("settings.security.changeNote", { email }),
+            setButton: t("settings.security.setButton"),
+            changeButton: t("settings.security.changeButton"),
+            sending: t("settings.security.sending"),
+            sent: t("settings.security.sent"),
+            sendFailed: t("settings.security.sendFailed"),
+            logOut: t("settings.security.logOut"),
+            logOutFailed: t("settings.security.logOutFailed"),
+          }}
+        />
       </AccountSettingsPane>
     </AccountSettingsFrame>
   );

package/templates/apps/web/app/[locale]/(authed)/account/security/security-panel.tsx

@@ -0,0 +1,102 @@
+"use client"; // Better Auth's client calls (requestPasswordReset, signOut) and router navigation need the browser
+
+/**
+ * SecurityPanel — the member's adapter over `SecuritySettings` (#8431 D3).
+ *
+ * The page (RSC) resolves the variant, the strings, the person's own address,
+ * the reset link's absolute `redirectTo` and where Log out lands; this island
+ * supplies the two actions:
+ *
+ *   - the Password row's request: Better Auth's `requestPasswordReset` for
+ *     the person's OWN address, with the server-built `redirectTo` (never one
+ *     derived from `window.location` — `forgot-password-card.tsx`'s rule);
+ *   - Log out: the spoke's same-origin sign-out endpoint when the page passes
+ *     one, else Better Auth's `signOut`. Only a log-out that succeeded
+ *     navigates (the `SignOutTrigger` rule).
+ *
+ * Its `authClient` is its own module-scope `createAuthClient()`, the
+ * `account-frame.tsx` idiom — never imported from `(auth)/`, a tree a spoke
+ * drops.
+ */
+
+import {
+  SecuritySettings,
+  type SecuritySettingsLabels,
+  type SecuritySignIn,
+} from "@working-theory/templates/account";
+import { createAuthClient } from "better-auth/react";
+import { useRouter } from "next/navigation";
+import type { ReactElement, ReactNode } from "react";
+
+const authClient = createAuthClient();
+
+/** The variant as the page resolved it — serializable, no functions. */
+export type SecurityPanelVariant =
+  | { kind: "password"; hasPassword: boolean }
+  | { kind: "sentence"; text: string }
+  | { kind: "hub"; text: string; link: { href: string; label: string } | null };
+
+export interface SecurityPanelProps {
+  /** `null`: the accounts read failed; `failed` renders in its place. */
+  variant: SecurityPanelVariant | null;
+  failed?: ReactNode;
+  /** The session's own address — the only one a link is ever requested for. */
+  email: string;
+  /** The absolute reset page the emailed link returns to. */
+  resetUrl: string;
+  /** A spoke's same-origin sign-out route; `null` signs out through Better Auth. */
+  signOutEndpoint: string | null;
+  /** The site's sign-in page, where Log out lands. */
+  signInHref: string;
+  labels: SecuritySettingsLabels;
+}
+
+export function SecurityPanel({
+  variant,
+  failed,
+  email,
+  resetUrl,
+  signOutEndpoint,
+  signInHref,
+  labels,
+}: SecurityPanelProps): ReactElement {
+  const router = useRouter();
+
+  async function requestLink(): Promise<boolean> {
+    // A refusal (the rate limit, the method off) resolves with `{ error }`; a
+    // network failure rejects. Both read as not sent.
+    return authClient.requestPasswordReset({ email, redirectTo: resetUrl }).then(
+      (res) => !res?.error,
+      () => false,
+    );
+  }
+
+  async function logOut(): Promise<boolean> {
+    let ok: boolean;
+    try {
+      if (signOutEndpoint !== null) {
+        const res = await fetch(signOutEndpoint, { method: "POST", credentials: "same-origin" });
+        ok = res.ok;
+      } else {
+        const res = await authClient.signOut();
+        ok = !res?.error;
+      }
+    } catch {
+      ok = false;
+    }
+    // A failed log-out leaves the person signed in: navigate nowhere.
+    if (!ok) return false;
+    router.push(signInHref);
+    router.refresh();
+    return true;
+  }
+
+  const signIn: SecuritySignIn | null =
+    variant === null
+      ? null
+      : variant.kind === "password"
+        ? { kind: "password", hasPassword: variant.hasPassword, onRequestLink: requestLink }
+        : variant;
+
+  return <SecuritySettings signIn={signIn} failed={failed} onLogOut={logOut} labels={labels} />;
+}

package/templates/apps/web/app/[locale]/(authed)/account/security/security-source.ts

@@ -0,0 +1,62 @@
+/**
+ * account/security/security-source.ts (server code) — which sign-in variant
+ * the member's Security tab shows (#8431 D2, spec
+ * docs/specs/8431-account-security-tab-human-sign-spec.md).
+ *
+ *   - hub      — a spoke that signs in through its hub: the hub's host and
+ *                origin, from `signInMethod()` and `hubSessionConfig()`.
+ *   - password — a site or hub that can email a password link
+ *                (`resetSendConfigured()`, C1): whether this person has a
+ *                password, from the session's own accounts.
+ *   - sentence — any other site: the deployment's configured methods.
+ *
+ * It tests no topology constant and imports nothing that loads `auth.ts`:
+ * `sign-in-method.ts` and the generated seam stay the account tree's seams
+ * (a hub-sign-in spoke drops `auth.ts`, and `spokeExclusions` refuses any
+ * surviving account file that reaches it).
+ *
+ * The seam is read as a namespace, never by a named import: a site whose
+ * seam was rendered before #8431 lacks the accounts reader (D2a), and a
+ * Security route `sync-routes` copies into it must still compile. There it
+ * shows the sentence — a retry cannot fix a stale seam (D2b).
+ */
+
+import { resetSendConfigured } from "../../../../../lib/auth-env";
+import { hubSessionConfig } from "../../../../../lib/hub-session/config";
+import * as seam from "../../../../../lib/topology.generated";
+import { logReadFailure } from "../account-data";
+import { signInMethod, type SignInMethodId } from "../sign-in-method";
+
+export type SecuritySource =
+  /** `hasPassword: null` — the accounts read failed. */
+  | { kind: "password"; hasPassword: boolean | null }
+  | { kind: "sentence"; methods: SignInMethodId[] }
+  | { kind: "hub"; hubHost: string | null; hubOrigin: string | null };
+
+type OwnAccountsReader = (headers: Headers) => Promise<ReadonlyArray<{ providerId: string }> | null>;
+
+/** The seam's accounts reader (D2a), or `null` on a seam rendered before it existed. */
+function ownAccountsReader(): OwnAccountsReader | null {
+  const reader: unknown = Reflect.get(seam, "readOwnAccounts");
+  return typeof reader === "function" ? (reader as OwnAccountsReader) : null;
+}
+
+export async function securitySource(headers: Headers): Promise<SecuritySource> {
+  const signIn = signInMethod();
+  if (signIn.kind === "hub") {
+    return { kind: "hub", hubHost: signIn.hubHost, hubOrigin: hubSessionConfig()?.hubOrigin ?? null };
+  }
+  if (!resetSendConfigured()) return { kind: "sentence", methods: signIn.methods };
+
+  const read = ownAccountsReader();
+  if (read === null) return { kind: "sentence", methods: signIn.methods };
+  try {
+    const accounts = await read(headers);
+    // `null` is a topology with no local accounts, which never reaches here.
+    if (accounts === null) return { kind: "password", hasPassword: null };
+    return { kind: "password", hasPassword: accounts.some((a) => a.providerId === "credential") };
+  } catch (err) {
+    logReadFailure("security-password", err);
+    return { kind: "password", hasPassword: null };
+  }
+}