create-ailk 0.2.0 → 0.4.0

package/templates/apps/mcp/src/tools/index.ts

@@ -124,27 +124,12 @@ export {
   type ScaffoldOutput,
 } from "./scaffold.js";
 
-export {
-  getFlowInputSchema,
-  getFlowOutputSchema,
-  ailkGetFlow,
-  type GetFlowInput,
-  type AilkGetFlowOutput,
-} from "./get_flow.js";
-
-export {
-  submitFlowStepInputSchemaForTool,
-  submitFlowStepOutputSchema,
-  ailkSubmitFlowStep,
-  type SubmitFlowStepInput,
-  type AilkSubmitFlowStepOutput,
-} from "./submit_flow_step.js";
-
-// The scheduling tools (list_availability, get_event_meta, create_booking) are
-// deliberately NOT re-exported here, and neither are the content-write tools
-// (create_page, update_page, delete_page). Both groups are module-conditional
-// slice files (#5182): a re-export from this barrel is a static path into a
-// file the OSS strip removes, which reds the public tree's type-check. They are
-// reached only through `createMcpServer`'s per-module loader in ../server.ts.
+// The scheduling tools (list_availability, get_event_meta, create_booking),
+// the content-write tools (create_page, update_page, delete_page), and the
+// signal-collectors flow tools (get_flow, submit_flow_step) are deliberately
+// NOT re-exported here. All three groups are module-conditional slice files
+// (#5182): a re-export from this barrel is a static path into a file the OSS
+// strip removes, which reds the public tree's type-check. They are reached
+// only through `createMcpServer`'s per-module loader in ../server.ts.
 // The rule this barrel now follows: it re-exports exactly the tools no module
 // gate can remove.

package/templates/apps/web/.env.example

@@ -26,6 +26,21 @@ CONTENT_BACKEND=mdx
 # Same convention as apps/workspace/lib/client-api.ts's identically-named var.
 # Should be apps/api's origin with NO trailing slash (a single trailing
 # slash is stripped before joining, but keep this clean regardless).
+#
+# THIS IS THE ONE BROWSER-SIDE NAME (#5397). All three browser readers of the
+# apps/api origin resolve it from this variable: resolveSubmitUrl
+# (packages/ui, the form blocks above), apps/workspace's client-api, and
+# @working-theory/api-client's getApiBase() — which runs in the browser
+# wherever a "use client" component binds it, e.g. the founder application's
+# ListingApplicationClient. getApiBase() previously read NEXT_PUBLIC_API_URL,
+# a name this file never documented, so a site configured exactly per these
+# docs sent its browser traffic to http://localhost:3001. That name is still
+# honoured as a deprecated fallback; do not set it in a new deployment.
+#
+# The server-side counterpart is AILK_API_URL (see the repo-root .env.example)
+# — deliberately NOT NEXT_PUBLIC_, and it still wins over this one when both
+# are set, so an RSC/Server-Action call can target an internal origin the
+# browser never sees.
 # NEXT_PUBLIC_AILK_API_URL=http://localhost:3002
 
 # =============================================================================

package/templates/apps/web/app/[locale]/(authed)/{waitlist/__tests__ → __tests__}/gate.test.tsx

@@ -24,14 +24,14 @@ jest.mock("next/headers", () => ({
 
 const mockGetSession = jest.fn();
 // eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth.ts's lazy Better-Auth singleton has no HTTP/DB boundary a unit test of the session-branch can mock without standing up Prisma.
-jest.mock("../../../../../auth", () => ({
+jest.mock("../../../../auth", () => ({
   __esModule: true,
   auth: { api: { getSession: (...args: unknown[]) => mockGetSession(...args) } },
 }));
 
 const mockGetActiveProviderIds = jest.fn();
 // eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth-env.ts is a pure env-introspection module with no external boundary to mock instead.
-jest.mock("../../../../../lib/auth-env", () => ({
+jest.mock("../../../../lib/auth-env", () => ({
   __esModule: true,
   getActiveProviderIds: () => mockGetActiveProviderIds(),
 }));
@@ -48,8 +48,8 @@ jest.mock("better-auth/react", () => ({
   createAuthClient: () => ({ signIn: { social: mockSignInSocial } }),
 }));
 
-import AuthedLayout from "../../layout";
-import { SignInGate } from "../../sign-in-gate";
+import AuthedLayout from "../layout";
+import { SignInGate } from "../sign-in-gate";
 
 describe("AuthedLayout — the (authed) session guard", () => {
   beforeEach(() => {

package/templates/apps/web/app/[locale]/flows/[slug]/FlowStepperClient.tsx

@@ -1,3 +1,4 @@
+// oss: false
 "use client";
 
 /**
@@ -53,7 +54,7 @@ import {
   type FlowStepperMessages,
   type FlowStepSubmitPayload,
   type FlowStepSubmitResult,
-} from "@working-theory/ui";
+} from "@working-theory/ui/slices/signal-collectors";
 import type { AeoScoreResult, FlowConfig, FlowState } from "@working-theory/validation";
 import {
   deriveFlags,

package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/FlowStepperClient.permalink.test.tsx

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * Tests for FlowStepperClient's permalink completion redirect on a
  * `mode:"recommending"` flow (#4770 D1/D7/D12).
@@ -64,7 +65,7 @@ interface MockFlowStepperProps {
 
 let captured: MockFlowStepperProps | undefined;
 
-jest.mock("@working-theory/ui", () => ({
+jest.mock("@working-theory/ui/slices/signal-collectors", () => ({
   FlowStepper: (props: MockFlowStepperProps) => {
     captured = props;
     return require("react").createElement("div", {

package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/FlowStepperClient.test.tsx

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * Tests for FlowStepperClient's segment-keyed completion redirect (#3960 D5).
  *
@@ -68,7 +69,7 @@ const PII_PAYLOAD = {
 
 let capturedOnCompleted: MockFlowStepperProps["onCompleted"];
 
-jest.mock("@working-theory/ui", () => ({
+jest.mock("@working-theory/ui/slices/signal-collectors", () => ({
   FlowStepper: (props: MockFlowStepperProps) => {
     capturedOnCompleted = props.onCompleted;
     async function handleSubmit(): Promise<void> {

package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/flow.actions.test.ts

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * Tests for submitFlowStepAction Server Action (#3957 D8).
  *

package/templates/apps/web/app/[locale]/flows/[slug]/__tests__/two-route-tool.test.tsx

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * #5053 — an interactive tool is two routes.
  *

package/templates/apps/web/app/[locale]/flows/[slug]/flow.actions.ts

@@ -1,3 +1,4 @@
+// oss: false
 "use server";
 
 /**
@@ -29,7 +30,7 @@
  */
 
 import { flows } from "@working-theory/api-client";
-import type { FlowStepSubmitResult } from "@working-theory/ui";
+import type { FlowStepSubmitResult } from "@working-theory/ui/slices/signal-collectors";
 import {
   flowSlugSchema,
   submitFlowStepInputSchema,

package/templates/apps/web/app/[locale]/flows/[slug]/page.tsx

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * /[locale]/flows/[slug] — the tool's LANDING route (#5053 D3/D5).
  *

package/templates/apps/web/app/[locale]/flows/[slug]/start/page.tsx

@@ -1,3 +1,4 @@
+// oss: false
 /**
  * /[locale]/flows/[slug]/start — the flow half of the two-route tool
  * (#5053 D3/D5). Moved here from `../page.tsx`, which is now the indexed

package/templates/apps/web/app/[locale]/pricing/page.tsx

@@ -0,0 +1,40 @@
+// Pricing page. Reads the Pricing MDX frontmatter, renders sections via
+// SectionRenderer, and emits a JSON-LD <script>.
+import type {
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections} from "@working-theory/page-renderer";
+import {
+  renderPage,
+  renderPageMetadata
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+}
+
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "Pricing", slug: "pricing", locale });
+}
+
+export default async function Page({
+  params,
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  return renderPage({
+    type: "Pricing",
+    slug: "pricing",
+    locale,
+    translationsNamespace: "pricing",
+    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(getPageSections !== undefined && { getPageSections }),
+  });
+}

package/templates/apps/web/app/[locale]/privacy/page.tsx

@@ -0,0 +1,40 @@
+// Privacy page. Reads the PrivacyPage MDX frontmatter, renders sections via
+// SectionRenderer, and emits a JSON-LD <script>.
+import type {
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections} from "@working-theory/page-renderer";
+import {
+  renderPage,
+  renderPageMetadata
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+}
+
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "PrivacyPage", slug: "privacy", locale });
+}
+
+export default async function Page({
+  params,
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  return renderPage({
+    type: "PrivacyPage",
+    slug: "privacy",
+    locale,
+    translationsNamespace: "privacy",
+    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(getPageSections !== undefined && { getPageSections }),
+  });
+}

package/templates/apps/web/app/[locale]/terms/page.tsx

@@ -0,0 +1,40 @@
+// Terms page. Reads the TermsPage MDX frontmatter, renders sections via
+// SectionRenderer, and emits a JSON-LD <script>.
+import type {
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections} from "@working-theory/page-renderer";
+import {
+  renderPage,
+  renderPageMetadata
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+}
+
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "TermsPage", slug: "terms", locale });
+}
+
+export default async function Page({
+  params,
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  return renderPage({
+    type: "TermsPage",
+    slug: "terms",
+    locale,
+    translationsNamespace: "terms",
+    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(getPageSections !== undefined && { getPageSections }),
+  });
+}

package/templates/apps/web/app/llms.txt/route.ts

@@ -4,9 +4,11 @@
  * Returns a plain-text index of AILK's content surface for LLM consumption,
  * following the llms.txt convention (https://llmstxt.org).
  *
- * Aggregates two surfaces:
- *   1. Section-catalog (MDX seeds in content/) via @working-theory/content-adapters
- *   2. Fumadocs blog corpus via blogSource.getPages()
+ * Indexes the section catalog (MDX seeds in content/) via
+ * @working-theory/content-adapters. Nothing is gated: a Free site has no blog
+ * (D-46), so there is no blog corpus to omit — `getBlogPages` defaults to an
+ * empty list and the docs + blog module ships its own variant of this route
+ * that reads `blogSource` (#5365 D9).
  *
  * Format per entry:
  *   - Title: <title>
@@ -14,8 +16,9 @@
  *     Description: <description>
  *
  * DI note: `createLlmsHandler` accepts optional `getContentAdapter` and
- * `getBlogPages` deps for testing — tests inject stubs to avoid mocking
- * internal modules. The exported `GET` uses the real implementations.
+ * `getBlogPages` deps — tests inject stubs, and the module's variant of this
+ * route supplies the real `blogSource` reader. The exported `GET` is
+ * unchanged either way.
  */
 
 import { SCHEMA_ORG_TYPES } from "@working-theory/content-adapters";
@@ -23,7 +26,6 @@ import type { ContentAdapter, SchemaOrgType } from "@working-theory/content-adap
 import { getContentAdapter as defaultGetContentAdapter } from "@working-theory/page-renderer";
 
 import { SITE_NAME } from "../../lib/site-brand";
-import { blogSource as defaultBlogSource } from "../../lib/source";
 import { resolveBaseUrl, slugToPath } from "../../src/lib/routes";
 
 export interface LlmsHandlerDeps {
@@ -33,8 +35,9 @@ export interface LlmsHandlerDeps {
    */
   getContentAdapter?: () => ContentAdapter;
   /**
-   * Blog pages getter. Defaults to the real blogSource.getPages().
-   * Override in tests to inject stub pages without mocking lib/source.
+   * Blog pages getter. Defaults to none — Free has no blog (D-46, #5365 D9).
+   * The docs + blog module's own copy of this route reads `blogSource`.
+   * Override in tests to inject stub pages.
    */
   getBlogPages?: () => Array<{ url: string; data: { title: string; description?: string } }>;
 }
@@ -45,7 +48,7 @@ export interface LlmsHandlerDeps {
  */
 export function createLlmsHandler(deps: LlmsHandlerDeps = {}) {
   const resolveAdapter = deps.getContentAdapter ?? defaultGetContentAdapter;
-  const resolveBlogPages = deps.getBlogPages ?? (() => defaultBlogSource.getPages() as Array<{ url: string; data: { title: string; description?: string } }>);
+  const resolveBlogPages = deps.getBlogPages ?? (() => []);
 
   return async function llmsGET(): Promise<Response> {
     const adapter = resolveAdapter();

package/templates/apps/web/jest.config.cjs

@@ -11,11 +11,11 @@ module.exports = {
   ],
   testMatch: ["**/__tests__/**/*.test.ts", "**/__tests__/**/*.test.tsx"],
   testPathIgnorePatterns: ["/node_modules/", "/.next/", "/dist/"],
-  // Ignore node_modules except fumadocs-* (ESM-only packages loaded via lib/source.ts → fumadocs-core/source).
+  // Ignore node_modules except @working-theory/* (their dist is ESM).
   // Mirrors the canonical jose carve-out used in apps/api, apps/mcp, and apps-paid/license-issuer.
   // Added: issue #1077
   transformIgnorePatterns: [
-    "/node_modules/(?!(\\.pnpm/)?(fumadocs-[^/]*?@?[^/]*?|@working-theory(?:\\+[^/]*?@?[^/]*?|/[^/]+))(/|$))",
+    "/node_modules/(?!(\\.pnpm/)?@working-theory(?:\\+[^/]*?@?[^/]*?|/[^/]+)(/|$))",
   ],
   moduleFileExtensions: ["ts", "tsx", "js", "jsx", "json"],
   // Workspace packages publish ESM in dist/, but ts-jest runs in CommonJS.
@@ -27,12 +27,6 @@ module.exports = {
     // Map all *.css to an empty stub — layout.tsx imports ./globals.css (#4090 item 1)
     // and CSS is not parseable by ts-jest's CommonJS transform (apps-paid/marketing-web precedent, #1531).
     "\\.css$": "<rootDir>/__tests__/__mocks__/style-mock.js",
-    // Fumadocs codegen output — produced by `pnpm --filter @working-theory/web build` into .source/
-    // The server entry uses top-level await + ESM-only fumadocs-mdx/runtime/server;
-    // map to a CJS stub so ts-jest can load modules that import lib/source.ts. (#1077)
-    // Stub lives in lib/__mocks__/ (committed) not .source/__mocks__/ (gitignored).
-    "^@/\\.source/server$": "<rootDir>/lib/__mocks__/source-server.js",
-    "^@/\\.source$": "<rootDir>/.source/index.ts",
     "^@working-theory/page-renderer/testing$":
       "<rootDir>/node_modules/@working-theory/page-renderer/dist/testing.js",
     "^@working-theory/page-renderer$":
@@ -51,8 +45,6 @@ module.exports = {
     "^@working-theory/api-client$": "<rootDir>/node_modules/@working-theory/api-client/dist/index.js",
     "^@working-theory/content-adapters$":
       "<rootDir>/node_modules/@working-theory/content-adapters/dist/index.js",
-    "^@working-theory/fumadocs-schema$":
-      "<rootDir>/node_modules/@working-theory/fumadocs-schema/dist/index.js",
     "^@working-theory/license$": "<rootDir>/node_modules/@working-theory/license/dist/index.js",
     "^@working-theory/jsonld$": "<rootDir>/node_modules/@working-theory/jsonld/dist/index.js",
     "^@working-theory/metadata$": "<rootDir>/node_modules/@working-theory/metadata/dist/index.js",
@@ -66,6 +58,7 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/schema-validator/dist/index.js",
     "^@working-theory/sections-registry$":
       "<rootDir>/node_modules/@working-theory/sections-registry/dist/index.js",
+
     "^@working-theory/templates/shells$":
       "<rootDir>/node_modules/@working-theory/templates/dist/shells/index.js",
     "^@working-theory/templates$": "<rootDir>/node_modules/@working-theory/templates/dist/index.js",
@@ -82,6 +75,14 @@ module.exports = {
     // tree, where nothing imports it, so the unused mapping is inert there.
     "^@working-theory/ui/slices/scheduling$":
       "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/scheduling.js",
+    // #5366: the signal-collectors slice's re-export subpath. Same reasoning
+    // as the scheduling mapping above.
+    "^@working-theory/ui/slices/signal-collectors$":
+      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/signal-collectors.js",
+    // #5364: the commerce slice's renderer-registration + CheckoutPriceCard
+    // re-export subpath. Same reasoning as the scheduling mapping above.
+    "^@working-theory/ui/slices/commerce$":
+      "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/commerce.js",
     "^@working-theory/theme$": "<rootDir>/node_modules/@working-theory/theme/dist/index.js",
     // site-config publishes ESM in dist/; map to source so ts-jest compiles it
     // through the same transformer as every sibling above. Only the
@@ -91,6 +92,11 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/site-config/dist/schema/index.js",
     "^@working-theory/validation$": "<rootDir>/node_modules/@working-theory/validation/dist/index.js",
     "^@working-theory/web-i18n$": "<rootDir>/node_modules/@working-theory/web-i18n/dist/index.js",
+    // The dependency-free tenancy-constants subpath (database/tenancy.ts —
+    // it imports only a type from @working-theory/ids). Mapped to source like
+    // every sibling above; `database/dist` is not built in this workspace
+    // pre-`pnpm build`.
+    "^@working-theory/database/tenancy$": "<rootDir>/node_modules/@working-theory/database/dist/tenancy.js",
     // #5025: pnpm keys next-intl's virtual-store path on its resolved peers,
     // so apps/web and packages/page-renderer can link two PHYSICALLY DISTINCT
     // copies of the same version — and a `jest.mock("next-intl/server")` in
@@ -126,9 +132,9 @@ module.exports = {
   },
   setupFilesAfterEnv: ["<rootDir>/__tests__/setup.ts"],
   transform: {
-    // fumadocs-core (16.10.6+) ships `import.meta.env` in its dist JS
-    // (e.g. dist/url-*.js), which the transformIgnorePatterns carve-out
-    // above lets reach a transformer instead of being required raw.
+    // Some `@working-theory/*` dist JS ships `import.meta`, which the
+    // transformIgnorePatterns carve-out above lets reach a transformer
+    // instead of being required raw.
     // `import.meta` has no CJS form, so it must run through the shared
     // import.meta -> {} rewrite BEFORE ts-jest — ts-jest's own
     // astTransformers hook never fires for a node_modules JS file (see the

package/templates/apps/web/lib/__tests__/server-api.test.ts

@@ -0,0 +1,61 @@
+/**
+ * Tests for `forwardedCookieInit` — the RSC cookie/origin-forwarding helper
+ * (#5371 shepherd fix-up).
+ *
+ * Contract: the returned `init.headers` always carries the forwarded
+ * `cookie`, and carries `origin` ONLY when the incoming request's `Origin`
+ * header is present — never a fabricated value. This is what lets a Server
+ * Action `PUT`/`PATCH` through `@working-theory/api-client`'s `workspace.*`
+ * namespace pass `apps/api`'s same-origin CSRF check (`isOriginAllowed`),
+ * which Node's server-side `fetch` cannot satisfy on its own since it never
+ * sets `Origin`.
+ */
+import { forwardedCookieInit } from "../server-api";
+
+const mockCookies = jest.fn();
+const mockHeaders = jest.fn();
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  cookies: (...args: unknown[]) => mockCookies(...args),
+  headers: (...args: unknown[]) => mockHeaders(...args),
+}));
+
+describe("forwardedCookieInit", () => {
+  beforeEach(() => {
+    mockCookies.mockReset();
+    mockHeaders.mockReset();
+  });
+
+  it("forwards cookie + origin when the incoming request carries an Origin header", async () => {
+    mockCookies.mockResolvedValue({
+      toString: () => "better-auth.session_token=abc",
+    });
+    mockHeaders.mockResolvedValue(
+      new Headers({ origin: "https://app.example.com" }),
+    );
+
+    const init = await forwardedCookieInit();
+
+    expect(init).toEqual({
+      headers: {
+        cookie: "better-auth.session_token=abc",
+        origin: "https://app.example.com",
+      },
+    });
+  });
+
+  it("forwards cookie alone — no origin key at all — when Origin is absent", async () => {
+    mockCookies.mockResolvedValue({
+      toString: () => "better-auth.session_token=abc",
+    });
+    mockHeaders.mockResolvedValue(new Headers());
+
+    const init = await forwardedCookieInit();
+
+    expect(init).toEqual({
+      headers: { cookie: "better-auth.session_token=abc" },
+    });
+    expect(init.headers).not.toHaveProperty("origin");
+  });
+});

package/templates/apps/web/lib/server-api.ts

@@ -3,22 +3,26 @@
  * (#4665 D9).
  *
  * Forwards the incoming request's cookies to `@working-theory/api-client`'s
- * `waitlistExperiments` namespace (B0, #4671) so `apps/api`'s cookie-session
- * auth preHandler resolves the SAME Better Auth session the browser holds —
- * both apps share the session store. GETs only, every page is an RSC; there
- * is no client fetch and no `NEXT_PUBLIC_` credential (D9).
+ * `waitlistExperiments` / `workspace` namespaces (B0, #4671; #5371) so
+ * `apps/api`'s cookie-session auth preHandler resolves the SAME Better Auth
+ * session the browser holds — both apps share the session store. Every page
+ * is an RSC and every write is a Server Action; there is no client fetch and
+ * no `NEXT_PUBLIC_` credential (D9). For a Server Action `PUT`/`PATCH`, the
+ * incoming request's `Origin` is forwarded alongside the cookie so
+ * `apps/api`'s same-origin CSRF check (`isOriginAllowed`) passes — Node's
+ * server-side `fetch` never sets `Origin` on its own.
  *
  * `apps/web` may not import `apps/api` directly (architecture.yaml) — every
- * read goes through `@working-theory/api-client`'s typed namespace, never a
+ * call goes through `@working-theory/api-client`'s typed namespace, never a
  * hand-rolled `fetch`. This module supplies exactly the two things that
- * namespace doesn't own: the cookie-forwarding `init` (B0's additive
+ * namespace doesn't own: the cookie/origin-forwarding `init` (B0's additive
  * `init?: { headers }` on `http.get`) and the envelope→`ApiError` unwrap
  * (mirrors `apps-paid/workspace/lib/api-error.ts`'s `unwrapEnvelope`, adapted to
  * the `@working-theory/api-client` `ApiResult<T>` shape B0 already returns
  * rather than re-parsing the wire envelope by hand).
  */
 
-import { cookies } from "next/headers";
+import { cookies, headers } from "next/headers";
 
 /**
  * Structural mirror of `@working-theory/api-client`'s `ApiResult<T>`
@@ -57,15 +61,27 @@ interface ErrorBody {
 }
 
 /**
- * Forward the incoming request's cookies as the `init` every
- * `waitlistExperiments.*` call accepts. Call once per request — `cookies()`
- * reads the current RSC request context.
+ * Forward the incoming request's cookies — and, when present, its `Origin` —
+ * as the `init` every `waitlistExperiments.*` / `workspace.*` call accepts.
+ * Call once per request — `cookies()` / `headers()` read the current RSC
+ * request context.
+ *
+ * The `Origin` forward matters for every non-GET call: `apps/api`'s
+ * `authPreHandler` (`isOriginAllowed`) requires a matching `Origin` header on
+ * a cookie-authenticated mutating request, and Node's server-side `fetch`
+ * (unlike a browser XHR/fetch) never sets one on its own. A Server Action's
+ * incoming request DOES carry the browser's real `Origin`, so re-forwarding
+ * it here — rather than fabricating one — lets a genuine same-origin write
+ * pass the check exactly as a browser-originated one would. RSC `GET`s are
+ * unaffected: `isOriginAllowed` short-circuits `true` for safe methods before
+ * it ever inspects the header.
  */
 export async function forwardedCookieInit(): Promise<{
-  headers: { cookie: string };
+  headers: { cookie: string; origin?: string };
 }> {
   const cookieHeader = (await cookies()).toString();
-  return { headers: { cookie: cookieHeader } };
+  const origin = (await headers()).get("origin");
+  return { headers: { cookie: cookieHeader, ...(origin ? { origin } : {}) } };
 }
 
 /**

package/templates/apps/web/messages/en.json

@@ -171,6 +171,14 @@
     "heading": "Partners",
     "emptyState": "Partners listing coming soon."
   },
+  "pricing": {
+    "heading": "Pricing",
+    "emptyState": "Pricing page content coming soon."
+  },
+  "privacy": {
+    "heading": "Privacy Policy",
+    "emptyState": "Privacy policy content coming soon."
+  },
   "products": {
     "heading": "Products",
     "emptyState": "Products listing coming soon."
@@ -215,6 +223,10 @@
     "description": "Deep dives into the architecture and internals of this site.",
     "emptyState": "Technical articles coming soon."
   },
+  "terms": {
+    "heading": "Terms of Service",
+    "emptyState": "Terms of service content coming soon."
+  },
   "testimonials": {
     "heading": "Testimonials",
     "emptyState": "Testimonials coming soon."
@@ -395,5 +407,51 @@
       "emptyHeadline": "No purchases yet",
       "emptyDescription": "Purchases you complete will appear here."
     }
+  },
+  "workspace": {
+    "title": "Workspace settings",
+    "description": "Your workspace name, site settings, and team.",
+    "nav": {
+      "account": "Account",
+      "general": "General",
+      "site": "Site",
+      "team": "Team"
+    },
+    "general": {
+      "heading": "General",
+      "nameLabel": "Workspace name",
+      "saveButton": "Save",
+      "saving": "Saving\u2026",
+      "saved": "Saved",
+      "saveError": "Could not save. Try again."
+    },
+    "site": {
+      "heading": "Site",
+      "identityHeading": "Identity",
+      "identityName": "Site name",
+      "identityUrl": "Site URL",
+      "identityDescription": "Description",
+      "seoHeading": "SEO",
+      "seoDescription": "Meta description",
+      "seoOgImage": "Social share image URL",
+      "themeHeading": "Theme",
+      "themeLightPrimary": "Primary colour (light)",
+      "themeLightAccent": "Accent colour (light)",
+      "themeDarkPrimary": "Primary colour (dark)",
+      "themeDarkAccent": "Accent colour (dark)",
+      "themeUnconfigured": "This site uses the default theme. Colours become editable once a theme is configured for the workspace.",
+      "saveButton": "Save",
+      "saving": "Saving\u2026",
+      "saved": "Saved",
+      "saveError": "Could not save. Try again."
+    },
+    "team": {
+      "heading": "Team",
+      "name": "Name",
+      "email": "Email",
+      "role": "Role",
+      "emptyHeadline": "No members yet",
+      "emptyDescription": "People with access to this workspace will appear here."
+    }
   }
 }