create-ailk 0.19.0 → 0.20.0

package/templates/apps/web/app/[locale]/(authed)/account/privacy/actions.ts

@@ -0,0 +1,65 @@
+"use server";
+
+/**
+ * A/privacy/actions.ts — the member Privacy and Notifications tabs' one
+ * consent write path (#8438 D14, D15, spec
+ * docs/specs/8438-consent-registry-and-ledger-step-spec.md).
+ *
+ * `setConsentAction` posts one answer through `POST /v1/member/consents`
+ * (`member.setConsent`) and answers in `ConsentSwitchList`'s own shape, so
+ * both tabs' switch lists can call it directly with no adapter. The
+ * banner's visitor id (`ailk-vid`) rides along as `x-ailk-consent-visitor`
+ * when present, linking its cookie choices to the client record this write
+ * resolves or creates (D6, D11, D12) — never failing the write when it is
+ * absent or invalid.
+ */
+
+import { member } from "@working-theory/api-client";
+import type { ConsentSwitchChangeResult } from "@working-theory/templates/account";
+import { cookies } from "next/headers";
+import { getLocale, getTranslations } from "next-intl/server";
+
+import { consentVisitorHeader, readConsentVisitor } from "../../../../../lib/consent-visitor";
+import { forwardedCookieInit } from "../../../../../lib/server-api";
+
+function formatDate(iso: string, locale: string): string {
+  return new Intl.DateTimeFormat(locale, { dateStyle: "medium" }).format(new Date(iso));
+}
+
+export async function setConsentAction(
+  purposeId: string,
+  granted: boolean,
+): Promise<ConsentSwitchChangeResult> {
+  const [t, locale] = await Promise.all([
+    getTranslations("account"),
+    getLocale(),
+  ]);
+
+  try {
+    const base = await forwardedCookieInit();
+    let visitorHeaders: Record<string, string> = {};
+    try {
+      const visitorId = readConsentVisitor(await cookies());
+      if (visitorId) visitorHeaders = consentVisitorHeader(visitorId);
+    } catch {
+      // No request scope to read, or no visitor cookie — write with none.
+    }
+
+    const res = await member.setConsent(
+      { purposeId, granted, locale },
+      { headers: { ...base.headers, ...visitorHeaders } },
+    );
+    if (!res.ok) {
+      return { ok: false, message: t("settings.privacy.unavailable") };
+    }
+
+    const state = res.body.purpose.state;
+    const at = state?.at ?? new Date().toISOString();
+    const dateLine = state?.granted
+      ? t("settings.privacy.given", { date: formatDate(at, locale) })
+      : t("settings.privacy.withdrawn", { date: formatDate(at, locale) });
+    return { ok: true, dateLine };
+  } catch {
+    return { ok: false, message: t("settings.privacy.unavailable") };
+  }
+}

package/templates/apps/web/app/[locale]/(authed)/account/privacy/page.tsx

@@ -0,0 +1,226 @@
+/**
+ * /[locale]/account/privacy — User settings › Privacy (#8438 D14, NEW).
+ *
+ * RSC, outside the account layout's SignedInShell (#8430), in the member's
+ * settings frame (D7) — standalone, the Admin's shape. In DOM order:
+ *
+ *   1. account-privacy-summary — one line with a link to the site's
+ *      privacy policy.
+ *   2. account-privacy-cookies — the current cookie-banner choice, read
+ *      from the request's OWN `ailk-consent` cookie (never the ledger —
+ *      the cookie stays the operative switch, C3), and a Change link
+ *      (moved here from Notifications, #8438 D15) to
+ *      `/privacy#cookie-settings`.
+ *   3. account-privacy-consents — one `ConsentSwitchList` row per
+ *      `area: "data"` purpose, or the "no other data-use consents" line.
+ *   4. account-privacy-agreements — a read-only `AgreementList` of every
+ *      agreement (`service_terms`, `account_terms`, …), or "None yet".
+ *   5. account-deletion — moved unchanged from General (#8438 D16).
+ *
+ * Sections 3 and 4 read `GET /v1/member/consents`; a failed read shows one
+ * line in their place and sections 1, 2 and 5 still render (D14).
+ */
+
+import { member } from "@working-theory/api-client";
+import {
+  AccountSettingsFrame,
+  AccountSettingsPane,
+  AgreementList,
+  ConsentSwitchList,
+} from "@working-theory/templates/account";
+import { localeHref } from "@working-theory/ui";
+import { Heading, Link, Text } from "@working-theory/ui/primitives";
+import type { Metadata } from "next";
+import { cookies } from "next/headers";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { accountSession } from "../account-data";
+import { DeletionRequest } from "../general/deletion-request";
+import { loadProfileSource } from "../general/profile-source";
+import { memberSettingsFrame, type Translate } from "../settings-frame";
+
+import { setConsentAction } from "./actions";
+
+/** The cookie banner's own choice cookie (`layout.tsx`'s `CONSENT_COOKIE_NAME`, #5557). */
+const CONSENT_COOKIE_NAME = "ailk-consent";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "account" });
+  return { title: t("settings.privacy.title"), description: t("settings.privacy.lead") };
+}
+
+export default async function AccountPrivacyPage({ params }: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "account" });
+  const session = await accountSession(locale);
+  const frame = memberSettingsFrame(locale, t as unknown as Translate, "privacy");
+
+  // Unreachable behind the (authed) gate; a session that expired between
+  // the layout and the page renders the pane's title alone.
+  if (!session) {
+    return (
+      <AccountSettingsFrame {...frame} name="">
+        <AccountSettingsPane
+          id="account-settings-privacy"
+          title={t("settings.privacy.title")}
+          lead={t("settings.privacy.lead")}
+        >
+          {null}
+        </AccountSettingsPane>
+      </AccountSettingsFrame>
+    );
+  }
+
+  const { ctx } = session;
+  const name = ctx.user.name || ctx.user.email;
+  const source = await loadProfileSource(ctx);
+
+  let cookieChoice: "accepted" | "declined" | null;
+  try {
+    const value = (await cookies()).get(CONSENT_COOKIE_NAME)?.value;
+    cookieChoice = value === "accepted" || value === "declined" ? value : null;
+  } catch {
+    cookieChoice = null;
+  }
+
+  let dataRows: { id: string; label: string; description?: string; granted: boolean; dateLine?: string }[] = [];
+  let agreementRows: { id: string; statement: string; version: number; acceptedLine?: string }[] = [];
+  let consentsAvailable = true;
+  try {
+    const res = await member.consents(ctx.init, { locale });
+    if (res.ok) {
+      dataRows = res.body.purposes
+        .filter((purpose) => purpose.area === "data")
+        .map((purpose) => ({
+          id: purpose.id,
+          label: purpose.statement,
+          granted: purpose.effective,
+          ...(purpose.description ? { description: purpose.description } : {}),
+          ...(purpose.state
+            ? {
+                dateLine: purpose.state.granted
+                  ? t("settings.privacy.given", { date: formatDate(purpose.state.at, locale) })
+                  : t("settings.privacy.withdrawn", { date: formatDate(purpose.state.at, locale) }),
+              }
+            : {}),
+        }));
+      agreementRows = res.body.purposes
+        .filter((purpose) => purpose.kind === "agreement")
+        .map((purpose) => ({
+          id: purpose.id,
+          statement: purpose.statement,
+          version: purpose.policyVersion,
+          ...(purpose.state?.granted
+            ? { acceptedLine: t("settings.privacy.accepted", { date: formatDate(purpose.state.at, locale) }) }
+            : {}),
+        }));
+    } else {
+      consentsAvailable = false;
+    }
+  } catch {
+    consentsAvailable = false;
+  }
+
+  return (
+    <AccountSettingsFrame {...frame} name={name}>
+      <AccountSettingsPane
+        id="account-settings-privacy"
+        title={t("settings.privacy.title")}
+        lead={t("settings.privacy.lead")}
+      >
+        <div data-testid="account-privacy-summary" className="flex flex-wrap items-baseline gap-1">
+          <Text as="span" variant="body-sm">
+            {t("settings.privacy.summary")}
+          </Text>
+          <Link href={localeHref(locale, "/privacy")} data-testid="account-privacy-policy">
+            {t("settings.privacy.policyLink")}
+          </Link>
+        </div>
+
+        <div data-testid="account-privacy-cookies" className="flex flex-col gap-1">
+          <Heading level={2} visual={4} className="!text-body-sm !font-medium">
+            {t("settings.privacy.cookiesTitle")}
+          </Heading>
+          <div className="flex flex-wrap items-baseline gap-3">
+            <Text as="span" variant="body-sm" tone="muted">
+              {cookieChoice === "accepted"
+                ? t("settings.privacy.cookiesAccepted")
+                : cookieChoice === "declined"
+                  ? t("settings.privacy.cookiesDeclined")
+                  : t("settings.privacy.cookiesUnset")}
+            </Text>
+            <Link
+              href={localeHref(locale, "/privacy#cookie-settings")}
+              className="inline-flex min-h-6 items-center"
+              data-testid="account-cookie-settings"
+            >
+              {t("settings.privacy.cookiesChange")}
+            </Link>
+          </div>
+        </div>
+
+        {consentsAvailable ? (
+          <>
+            <div data-testid="account-privacy-consents" className="flex flex-col gap-2">
+              <Heading level={2} visual={4} className="!text-body-sm !font-medium">
+                {t("settings.privacy.consentsTitle")}
+              </Heading>
+              <ConsentSwitchList
+                rows={dataRows}
+                onChange={setConsentAction}
+                emptyLine={t("settings.privacy.consentsEmpty")}
+                testIdPrefix="account-privacy-data-consent"
+              />
+            </div>
+
+            <div data-testid="account-privacy-agreements" className="flex flex-col gap-2">
+              <Heading level={2} visual={4} className="!text-body-sm !font-medium">
+                {t("settings.privacy.agreementsTitle")}
+              </Heading>
+              <AgreementList
+                rows={agreementRows}
+                notAcceptedLine={t("settings.privacy.agreementsEmpty")}
+                emptyLine={t("settings.privacy.agreementsEmpty")}
+                testIdPrefix="account-privacy-agreement"
+              />
+            </div>
+          </>
+        ) : (
+          <span data-testid="account-privacy-unavailable">
+            <Text as="p" variant="body-sm" tone="muted">
+              {t("settings.privacy.unavailable")}
+            </Text>
+          </span>
+        )}
+
+        <div data-testid="account-deletion">
+          <DeletionRequest
+            via={source.via}
+            supportHref={localeHref(locale, "/account/support")}
+            labels={{
+              lead: t("settings.privacy.deletionLead"),
+              action: t("settings.privacy.deletion"),
+              sentSite: t("settings.privacy.deletionSentSite"),
+              sentHub: t("settings.privacy.deletionSentHub"),
+              unverified: t("settings.privacy.deletionUnverified"),
+              unavailable: t("settings.privacy.deletionUnavailable"),
+              error: t("settings.privacy.deletionError"),
+              viaSupport: t("settings.privacy.deletionViaSupport"),
+              supportLink: t("settings.privacy.deletionSupportLink"),
+            }}
+          />
+        </div>
+      </AccountSettingsPane>
+    </AccountSettingsFrame>
+  );
+}
+
+function formatDate(iso: string, locale: string): string {
+  return new Intl.DateTimeFormat(locale, { dateStyle: "medium" }).format(new Date(iso));
+}

package/templates/apps/web/app/[locale]/(authed)/account/security/page.tsx

@@ -1,23 +1,35 @@
 /**
- * /[locale]/account/security — User settings › Security (#8339 D8, NEW).
+ * /[locale]/account/security — User settings › Security (#8339 D8; #8431 D3).
  *
- * RSC, inside the account layout's SignedInShell with the rail visible, in
- * the member's four-tab settings frame (D7). Holds the former Sign-in
- * section's content, moved here verbatim from General (#8339 C6): how this
- * member signs in (`signInMethod()`, #8232 D7) — the hub line (named or
- * unnamed), the configured methods, or none.
+ * RSC, outside the account layout's SignedInShell (#8430), in the member's
+ * four-tab settings frame (D7) — standalone, the Admin's shape. It shows how
+ * this person signs in, then Log out, through the shared `SecuritySettings`
+ * (`security-panel.tsx` supplies its actions):
+ *
+ *   - a site or hub that can email a password link: the Password row, set
+ *     or changed by an emailed link to the person's own address;
+ *   - any other site: one sentence naming the deployment's methods;
+ *   - a spoke that signs in through its hub: "Your sign-in is managed at
+ *     <hub>", with a link to the hub's own Security page.
+ *
+ * `security-source.ts` picks the variant; this page turns it into text.
  */
 
 import { AccountSettingsFrame, AccountSettingsPane } from "@working-theory/templates/account";
-import { DescriptionList } from "@working-theory/ui/blocks";
-import { Text } from "@working-theory/ui/primitives";
+import { localeHref } from "@working-theory/ui";
 import type { Metadata } from "next";
+import { headers } from "next/headers";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
+import { SIGN_IN_PATH, SIGN_OUT_ENDPOINT } from "../../../../../lib/topology.generated";
 import { accountSession } from "../account-data";
+import { ErrorRow } from "../error-row";
 import { memberSettingsFrame, type Translate } from "../settings-frame";
-import { signInMethod, type SignInMethodId } from "../sign-in-method";
+import type { SignInMethodId } from "../sign-in-method";
+
+import { SecurityPanel, type SecurityPanelVariant } from "./security-panel";
+import { securitySource } from "./security-source";
 
 interface Props {
   params: Promise<{ locale: string }>;
@@ -29,12 +41,12 @@ export async function generateMetadata({ params }: Props): Promise<Metadata> {
   return { title: t("settings.security.title"), description: t("settings.signIn.lead") };
 }
 
-/** Each sign-in method's label key. */
+/** Each sign-in method's phrase in the sentence (C5). */
 const METHOD_KEYS = {
-  google: "settings.signIn.methods.google",
-  github: "settings.signIn.methods.github",
-  "magic-link": "settings.signIn.methods.magicLink",
-  email: "settings.signIn.methods.password",
+  google: "settings.security.methods.google",
+  github: "settings.security.methods.github",
+  "magic-link": "settings.security.methods.magicLink",
+  email: "settings.security.methods.password",
 } as const satisfies Record<SignInMethodId, string>;
 
 export default async function AccountSecurityPage({ params }: Props): Promise<ReactElement> {
@@ -42,9 +54,41 @@ export default async function AccountSecurityPage({ params }: Props): Promise<Re
   const t = await getTranslations({ locale, namespace: "account" });
   const session = await accountSession(locale);
   const frame = memberSettingsFrame(locale, t as unknown as Translate, "security");
-  const name = session?.ctx.user.name || session?.ctx.user.email || "";
+  const email = session?.ctx.user.email ?? "";
+  const name = session?.ctx.user.name || email;
+
+  const source = await securitySource(await headers());
 
-  const signIn = signInMethod();
+  let variant: SecurityPanelVariant | null;
+  if (source.kind === "password") {
+    variant = source.hasPassword === null ? null : { kind: "password", hasPassword: source.hasPassword };
+  } else if (source.kind === "sentence") {
+    const methods = source.methods.map((id) => t(METHOD_KEYS[id], { email }));
+    variant = {
+      kind: "sentence",
+      text:
+        methods.length > 0
+          ? t("settings.security.signsInWith", {
+              methods: new Intl.ListFormat(locale, { type: "disjunction" }).format(methods),
+            })
+          : t("settings.security.signedInAs", { email }),
+    };
+  } else {
+    variant = {
+      kind: "hub",
+      text:
+        source.hubHost !== null
+          ? t("settings.security.managedAt", { hub: source.hubHost })
+          : t("settings.security.managedUnnamed"),
+      link:
+        source.hubHost !== null && source.hubOrigin !== null
+          ? {
+              href: new URL("/account/security", source.hubOrigin).href,
+              label: t("settings.security.manageOnHub", { hub: source.hubHost }),
+            }
+          : null,
+    };
+  }
 
   return (
     <AccountSettingsFrame {...frame} name={name}>
@@ -53,27 +97,35 @@ export default async function AccountSecurityPage({ params }: Props): Promise<Re
         title={t("settings.security.title")}
         lead={t("settings.signIn.lead")}
       >
-        <div data-testid="account-signin-method">
-          {signIn.kind === "hub" ? (
-            <Text as="p" variant="body-sm" tone="muted">
-              {signIn.hubHost !== null
-                ? t("settings.signIn.viaHub", { hub: signIn.hubHost })
-                : t("settings.signIn.viaHubUnnamed")}
-            </Text>
-          ) : signIn.methods.length > 0 ? (
-            <DescriptionList
-              items={signIn.methods.map((id) => ({
-                label: t(METHOD_KEYS[id]),
-                value: t("settings.signIn.available"),
-                "data-testid": `account-signin-${id}`,
-              }))}
-            />
-          ) : (
-            <Text as="p" variant="body-sm" tone="muted">
-              {t("settings.signIn.none")}
-            </Text>
-          )}
-        </div>
+        <SecurityPanel
+          variant={variant}
+          failed={
+            <ErrorRow message={t("settings.security.passwordUnavailable")} retryLabel={t("inbox.retry")} />
+          }
+          email={email}
+          // Absolute and same-origin, built here from BETTER_AUTH_URL — the
+          // `(auth)/forgot-password/page.tsx` derivation.
+          resetUrl={`${process.env.BETTER_AUTH_URL ?? ""}${localeHref(locale, "/reset-password")}`}
+          signOutEndpoint={SIGN_OUT_ENDPOINT}
+          signInHref={localeHref(locale, SIGN_IN_PATH ?? "/")}
+          labels={{
+            methodsHeading: t("settings.security.methodsHeading"),
+            passwordLabel: t("settings.security.passwordLabel"),
+            passwordSet: t("settings.security.passwordSet"),
+            passwordNotSet: t("settings.security.passwordNotSet"),
+            setHint: t("settings.security.setHint"),
+            changeHint: t("settings.security.changeHint"),
+            setNote: t("settings.security.setNote", { email }),
+            changeNote: t("settings.security.changeNote", { email }),
+            setButton: t("settings.security.setButton"),
+            changeButton: t("settings.security.changeButton"),
+            sending: t("settings.security.sending"),
+            sent: t("settings.security.sent"),
+            sendFailed: t("settings.security.sendFailed"),
+            logOut: t("settings.security.logOut"),
+            logOutFailed: t("settings.security.logOutFailed"),
+          }}
+        />
       </AccountSettingsPane>
     </AccountSettingsFrame>
   );

package/templates/apps/web/app/[locale]/(authed)/account/security/security-panel.tsx

@@ -0,0 +1,102 @@
+"use client"; // Better Auth's client calls (requestPasswordReset, signOut) and router navigation need the browser
+
+/**
+ * SecurityPanel — the member's adapter over `SecuritySettings` (#8431 D3).
+ *
+ * The page (RSC) resolves the variant, the strings, the person's own address,
+ * the reset link's absolute `redirectTo` and where Log out lands; this island
+ * supplies the two actions:
+ *
+ *   - the Password row's request: Better Auth's `requestPasswordReset` for
+ *     the person's OWN address, with the server-built `redirectTo` (never one
+ *     derived from `window.location` — `forgot-password-card.tsx`'s rule);
+ *   - Log out: the spoke's same-origin sign-out endpoint when the page passes
+ *     one, else Better Auth's `signOut`. Only a log-out that succeeded
+ *     navigates (the `SignOutTrigger` rule).
+ *
+ * Its `authClient` is its own module-scope `createAuthClient()`, the
+ * `account-frame.tsx` idiom — never imported from `(auth)/`, a tree a spoke
+ * drops.
+ */
+
+import {
+  SecuritySettings,
+  type SecuritySettingsLabels,
+  type SecuritySignIn,
+} from "@working-theory/templates/account";
+import { createAuthClient } from "better-auth/react";
+import { useRouter } from "next/navigation";
+import type { ReactElement, ReactNode } from "react";
+
+const authClient = createAuthClient();
+
+/** The variant as the page resolved it — serializable, no functions. */
+export type SecurityPanelVariant =
+  | { kind: "password"; hasPassword: boolean }
+  | { kind: "sentence"; text: string }
+  | { kind: "hub"; text: string; link: { href: string; label: string } | null };
+
+export interface SecurityPanelProps {
+  /** `null`: the accounts read failed; `failed` renders in its place. */
+  variant: SecurityPanelVariant | null;
+  failed?: ReactNode;
+  /** The session's own address — the only one a link is ever requested for. */
+  email: string;
+  /** The absolute reset page the emailed link returns to. */
+  resetUrl: string;
+  /** A spoke's same-origin sign-out route; `null` signs out through Better Auth. */
+  signOutEndpoint: string | null;
+  /** The site's sign-in page, where Log out lands. */
+  signInHref: string;
+  labels: SecuritySettingsLabels;
+}
+
+export function SecurityPanel({
+  variant,
+  failed,
+  email,
+  resetUrl,
+  signOutEndpoint,
+  signInHref,
+  labels,
+}: SecurityPanelProps): ReactElement {
+  const router = useRouter();
+
+  async function requestLink(): Promise<boolean> {
+    // A refusal (the rate limit, the method off) resolves with `{ error }`; a
+    // network failure rejects. Both read as not sent.
+    return authClient.requestPasswordReset({ email, redirectTo: resetUrl }).then(
+      (res) => !res?.error,
+      () => false,
+    );
+  }
+
+  async function logOut(): Promise<boolean> {
+    let ok: boolean;
+    try {
+      if (signOutEndpoint !== null) {
+        const res = await fetch(signOutEndpoint, { method: "POST", credentials: "same-origin" });
+        ok = res.ok;
+      } else {
+        const res = await authClient.signOut();
+        ok = !res?.error;
+      }
+    } catch {
+      ok = false;
+    }
+    // A failed log-out leaves the person signed in: navigate nowhere.
+    if (!ok) return false;
+    router.push(signInHref);
+    router.refresh();
+    return true;
+  }
+
+  const signIn: SecuritySignIn | null =
+    variant === null
+      ? null
+      : variant.kind === "password"
+        ? { kind: "password", hasPassword: variant.hasPassword, onRequestLink: requestLink }
+        : variant;
+
+  return <SecuritySettings signIn={signIn} failed={failed} onLogOut={logOut} labels={labels} />;
+}

package/templates/apps/web/app/[locale]/(authed)/account/security/security-source.ts

@@ -0,0 +1,62 @@
+/**
+ * account/security/security-source.ts (server code) — which sign-in variant
+ * the member's Security tab shows (#8431 D2, spec
+ * docs/specs/8431-account-security-tab-human-sign-spec.md).
+ *
+ *   - hub      — a spoke that signs in through its hub: the hub's host and
+ *                origin, from `signInMethod()` and `hubSessionConfig()`.
+ *   - password — a site or hub that can email a password link
+ *                (`resetSendConfigured()`, C1): whether this person has a
+ *                password, from the session's own accounts.
+ *   - sentence — any other site: the deployment's configured methods.
+ *
+ * It tests no topology constant and imports nothing that loads `auth.ts`:
+ * `sign-in-method.ts` and the generated seam stay the account tree's seams
+ * (a hub-sign-in spoke drops `auth.ts`, and `spokeExclusions` refuses any
+ * surviving account file that reaches it).
+ *
+ * The seam is read as a namespace, never by a named import: a site whose
+ * seam was rendered before #8431 lacks the accounts reader (D2a), and a
+ * Security route `sync-routes` copies into it must still compile. There it
+ * shows the sentence — a retry cannot fix a stale seam (D2b).
+ */
+
+import { resetSendConfigured } from "../../../../../lib/auth-env";
+import { hubSessionConfig } from "../../../../../lib/hub-session/config";
+import * as seam from "../../../../../lib/topology.generated";
+import { logReadFailure } from "../account-data";
+import { signInMethod, type SignInMethodId } from "../sign-in-method";
+
+export type SecuritySource =
+  /** `hasPassword: null` — the accounts read failed. */
+  | { kind: "password"; hasPassword: boolean | null }
+  | { kind: "sentence"; methods: SignInMethodId[] }
+  | { kind: "hub"; hubHost: string | null; hubOrigin: string | null };
+
+type OwnAccountsReader = (headers: Headers) => Promise<ReadonlyArray<{ providerId: string }> | null>;
+
+/** The seam's accounts reader (D2a), or `null` on a seam rendered before it existed. */
+function ownAccountsReader(): OwnAccountsReader | null {
+  const reader: unknown = Reflect.get(seam, "readOwnAccounts");
+  return typeof reader === "function" ? (reader as OwnAccountsReader) : null;
+}
+
+export async function securitySource(headers: Headers): Promise<SecuritySource> {
+  const signIn = signInMethod();
+  if (signIn.kind === "hub") {
+    return { kind: "hub", hubHost: signIn.hubHost, hubOrigin: hubSessionConfig()?.hubOrigin ?? null };
+  }
+  if (!resetSendConfigured()) return { kind: "sentence", methods: signIn.methods };
+
+  const read = ownAccountsReader();
+  if (read === null) return { kind: "sentence", methods: signIn.methods };
+  try {
+    const accounts = await read(headers);
+    // `null` is a topology with no local accounts, which never reaches here.
+    if (accounts === null) return { kind: "password", hasPassword: null };
+    return { kind: "password", hasPassword: accounts.some((a) => a.providerId === "credential") };
+  } catch (err) {
+    logReadFailure("security-password", err);
+    return { kind: "password", hasPassword: null };
+  }
+}