create-ailk 0.21.0 → 0.22.0

package/templates/database/__tests__/flow-completion.db.test.ts

@@ -0,0 +1,136 @@
+/**
+ * @file flow-completion.db.test.ts
+ *
+ * LIVE-DATABASE proof of a magnet's completion columns (#8757, spec
+ * docs/specs/8757-a-per-magnet-completion-setting-spec.md D2, AC-2). Requires
+ * DATABASE_URL pointing at a Postgres with the migrations applied — SKIPS
+ * when DATABASE_URL is unset (the repo convention; the `apps/api Route Tests
+ * (Postgres)` workflow exercises it).
+ *
+ * Uses the `pg` driver directly, in ONE transaction that is rolled back. What
+ * it proves that a mock cannot:
+ *   1. The migration's backfill block, run over magnets at the five slugs,
+ *      leaves `contact` and `form` at `lead` and sets the three process
+ *      magnets to `invite`; a second run changes nothing.
+ *   2. Each CHECK refuses what it names.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { Client } from "pg";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const MIGRATION_SQL = readFileSync(
+  join(__dirname, "..", "migrations", "20261018120000_flow_completion", "migration.sql"),
+  "utf8",
+);
+
+/** The text between the `-- BEGIN completion backfill` / `-- END …` markers. */
+function backfillBlock(sql: string): string {
+  const match = /-- BEGIN completion backfill\n([\s\S]*?)-- END completion backfill/.exec(sql);
+  if (!match?.[1]) throw new Error("completion backfill markers not found");
+  return match[1];
+}
+
+const WS = "wksp_01920000-8757-7000-8000-0000000000c1";
+const SLUGS = ["contact", "onboarding", "request-quote", "job-application", "form"] as const;
+
+describeDb("the magnet completion columns (#8757 D2, AC-2, live DB)", () => {
+  let db: Client;
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+    await db.query("BEGIN");
+  });
+
+  afterAll(async () => {
+    await db.query("ROLLBACK");
+    await db.end();
+  });
+
+  /** Insert one magnet at `slug`, with any of the completion columns. */
+  const insertMagnet = (slug: string, cols: Record<string, unknown> = {}) => {
+    const all: Record<string, unknown> = {
+      site_id: WS,
+      workspace_id: WS,
+      slug,
+      config: JSON.stringify({ steps: [] }),
+      title: `Magnet ${slug}`,
+      status: "draft",
+      updated_at: new Date("2026-10-01T09:00:00.000Z"),
+      ...cols,
+    };
+    const names = Object.keys(all);
+    return db.query<{ id: string }>(
+      `INSERT INTO "flow_definitions" (${names.map((n) => `"${n}"`).join(", ")})
+       VALUES (${names.map((_, i) => `$${i + 1}`).join(", ")}) RETURNING "id"`,
+      names.map((n) => all[n]),
+    );
+  };
+
+  /** Run `run` inside a savepoint; resolve to the violated constraint's name, or null. */
+  const violation = async (run: () => Promise<unknown>): Promise<string | null> => {
+    await db.query("SAVEPOINT attempt");
+    try {
+      await run();
+      await db.query("RELEASE SAVEPOINT attempt");
+      return null;
+    } catch (err) {
+      await db.query("ROLLBACK TO SAVEPOINT attempt");
+      return (err as { constraint?: string }).constraint ?? String(err);
+    }
+  };
+
+  const completions = async () =>
+    Object.fromEntries(
+      (
+        await db.query<{ slug: string; completion: string; checkout_offering: string | null }>(
+          `SELECT "slug", "completion", "checkout_offering" FROM "flow_definitions" WHERE "workspace_id" = $1`,
+          [WS],
+        )
+      ).rows.map((r) => [r.slug, [r.completion, r.checkout_offering]]),
+    );
+
+  it("the backfill sets the three process magnets to invite and leaves contact and form at lead, idempotently", async () => {
+    for (const slug of SLUGS) await insertMagnet(slug);
+    const before = await completions();
+    for (const slug of SLUGS) expect(before[slug]).toEqual(["lead", null]);
+
+    await db.query(backfillBlock(MIGRATION_SQL));
+    const after = await completions();
+    expect(after).toEqual({
+      contact: ["lead", null],
+      form: ["lead", null],
+      onboarding: ["invite", null],
+      "request-quote": ["invite", null],
+      "job-application": ["invite", null],
+    });
+
+    const rerun = await db.query(backfillBlock(MIGRATION_SQL));
+    expect(await completions()).toEqual(after);
+    // The re-run matches the same rows but stores the same values.
+    expect(rerun.rowCount).toBeGreaterThanOrEqual(3);
+  });
+
+  it.each([
+    ["checkout with no offering", { completion: "checkout", checkout_offering: null }, "flow_definitions_checkout_offering_pair"],
+    ["an offering beside lead", { completion: "lead", checkout_offering: "retainer" }, "flow_definitions_checkout_offering_pair"],
+    ["a capitalised key", { completion: "checkout", checkout_offering: "Bad" }, "flow_definitions_checkout_offering_format"],
+    ["an underscored key", { completion: "checkout", checkout_offering: "a_b" }, "flow_definitions_checkout_offering_format"],
+    ["a fourth value", { completion: "other", checkout_offering: null }, "flow_definitions_completion_domain"],
+  ])("refuses %s", async (_label, cols, constraint) => {
+    expect(await violation(() => insertMagnet(`refused-${constraint.length}-${String(cols.completion)}`, cols))).toBe(
+      constraint,
+    );
+  });
+
+  it("accepts checkout with a listed-shape offering", async () => {
+    expect(
+      await violation(() =>
+        insertMagnet("paid-waitlist", { completion: "checkout", checkout_offering: "retainer" }),
+      ),
+    ).toBeNull();
+  });
+});

package/templates/database/__tests__/seed.test.ts

@@ -13,9 +13,12 @@
 import {
   CONTACT_FORM_FLOW_SLUG,
   contactFormFlowConfig,
+  JOB_APPLICATION_FLOW_SLUG,
+  jobApplicationFlowConfig,
   REQUEST_QUOTE_FLOW_SLUG,
   REQUEST_QUOTE_FLOW_TITLE,
   requestQuoteFlowConfig,
+  STANDARD_MAGNET_COMPLETIONS,
 } from "@working-theory/validation";
 
 import {
@@ -109,7 +112,7 @@ describe("provisionDefaultWorkspace — the request-quote magnet (#8168 D8, C4,
 
     await provisionDefaultWorkspace(prisma);
 
-    expect(flowDefinitionUpsert).toHaveBeenCalledTimes(2);
+    expect(flowDefinitionUpsert).toHaveBeenCalledTimes(3);
     expect(flowDefinitionUpsert).toHaveBeenNthCalledWith(1, {
       where: {
         siteId_slug: { siteId: DEFAULT_WORKSPACE_ID, slug: REQUEST_QUOTE_FLOW_SLUG },
@@ -123,6 +126,7 @@ describe("provisionDefaultWorkspace — the request-quote magnet (#8168 D8, C4,
         title: REQUEST_QUOTE_FLOW_TITLE,
         status: "draft",
         customersEnabled: true,
+        completion: STANDARD_MAGNET_COMPLETIONS[REQUEST_QUOTE_FLOW_SLUG],
       },
       // Empty: an existing (site_id, slug) row is never overwritten (D8, C6).
       update: {},
@@ -160,6 +164,7 @@ describe("provisionDefaultWorkspace — the Contact form magnet (#8661 D3, AC-1)
         title: "Contact form",
         status: "live",
         customersEnabled: false,
+        completion: STANDARD_MAGNET_COMPLETIONS[CONTACT_FORM_FLOW_SLUG],
         landingPage: "/contact",
       },
       // Empty: a re-run never overwrites the owner's edits.
@@ -175,3 +180,31 @@ describe("provisionDefaultWorkspace — the Contact form magnet (#8661 D3, AC-1)
     expect(flowDefinitionUpsert).not.toHaveBeenCalled();
   });
 });
+
+describe("provisionDefaultWorkspace — the Job application magnet (#8746 D3, AC-2)", () => {
+  it("upserts the default workspace's live Job application, insert-if-absent", async () => {
+    const { prisma, flowDefinitionUpsert } = makeStubPrisma(0);
+
+    await provisionDefaultWorkspace(prisma);
+
+    expect(flowDefinitionUpsert).toHaveBeenNthCalledWith(3, {
+      where: {
+        siteId_slug: { siteId: DEFAULT_WORKSPACE_ID, slug: JOB_APPLICATION_FLOW_SLUG },
+      },
+      create: {
+        siteId: DEFAULT_WORKSPACE_ID,
+        workspaceId: DEFAULT_WORKSPACE_ID,
+        slug: "job-application",
+        config: jobApplicationFlowConfig,
+        kind: "diagnostic",
+        title: "Job application",
+        status: "live",
+        customersEnabled: false,
+        completion: STANDARD_MAGNET_COMPLETIONS[JOB_APPLICATION_FLOW_SLUG],
+        landingPage: "/careers",
+      },
+      // Empty: a re-run never overwrites the owner's edits.
+      update: {},
+    });
+  });
+});

package/templates/database/inbox/schema.prisma

@@ -473,6 +473,18 @@ model FlowDefinition {
   /// `request-quote` magnet is `draft` (never served anonymously) with
   /// `customersEnabled = true`.
   customersEnabled Boolean @default(false) @map("customers_enabled")
+  /// #8757 D1/D2 — what happens after someone submits the magnet: `lead`
+  /// (the thank-you only), `invite` (an account link with the email
+  /// prefilled) or `checkout` (continue to `checkoutOffering`). A column, on
+  /// the `customersEnabled` footing: no seed or config names it. Closed by
+  /// the `flow_definitions_completion_domain` CHECK; the standard defaults are
+  /// the migration's backfill by slug (`STANDARD_MAGNET_COMPLETIONS`).
+  completion String @default("lead") @db.VarChar(16)
+  /// #8757 D1/D2 — the offering key a `checkout` magnet continues to; NULL
+  /// exactly when `completion` is not `checkout`
+  /// (`flow_definitions_checkout_offering_pair`), in the spoke checkout slug
+  /// format (`flow_definitions_checkout_offering_format`).
+  checkoutOffering String? @map("checkout_offering") @db.VarChar(40)
   createdAt DateTime @default(now()) @map("created_at")
   updatedAt DateTime @updatedAt @map("updated_at")
 
@@ -1283,8 +1295,11 @@ model ProjectListing {
 /// would prove nothing once that row is edited, and `statementHash` groups
 /// identical wordings. `locale` is the locale the statement was actually
 /// served in, not the one requested. `purposeId` is the site-config registry
-/// id — the join key across surfaces. Written only by
-/// apps/api/src/services/consent.ts.
+/// id — the join key across surfaces. Two writers: apps/api/src/services/consent.ts
+/// (every source), and the web sign-up hook apps/web/lib/sign-up-agreements.ts
+/// (#8765 D4), which writes only `sign_up` rows (subject `user`) of a user it
+/// creates in the same Better Auth transaction, from evidence the API built
+/// with consent.ts's own functions.
 model ConsentGrant {
   id            String   @id @default(dbgenerated("('cnsnt_'::text || (uuidv7())::text)")) @db.Text
   siteId        String   @map("site_id")

package/templates/database/migrations/20261018120000_flow_completion/migration.sql

@@ -0,0 +1,52 @@
+-- #8757 — a per-magnet completion setting (spec
+-- docs/specs/8757-a-per-magnet-completion-setting-spec.md D1, D2).
+--
+--   flow_definitions (2 columns) — what happens after someone submits the
+--                    magnet (`completion`: `lead`, `invite` or `checkout`),
+--                    and, for `checkout` only, the offering key it continues
+--                    to. The vocabulary is `FLOW_COMPLETIONS` and
+--                    `flowCheckoutOfferingSchema` in
+--                    packages/validation/src/schemas/flow-completion.ts.
+--
+-- Every existing row reads `completion = 'lead'` from the constant default —
+-- Postgres stores the default in the catalog and rewrites no row for it, so
+-- `contact` and every waitlist get `lead` with no statement. Each CHECK below
+-- is added NOT VALID and then VALIDATEd; every existing row passes each one
+-- (`lead` with a NULL offering).
+--
+-- The one UPDATE is the standard-defaults backfill BY SLUG (the issue's D2,
+-- D7): `onboarding`, `request-quote` and `job-application` → `invite`
+-- (`STANDARD_MAGNET_COMPLETIONS`). A test re-reads the block between the
+-- markers. `updated_at` is Prisma-managed, so the backfill leaves it alone.
+-- A magnet created after this migration takes the column default until the
+-- seed constants carry `completion` (#8759).
+--
+-- Rollout: deploy this migration BEFORE the API code that reads and writes the
+-- columns; code without them fails every magnet read.
+--
+-- Rollback: ALTER TABLE "flow_definitions" DROP COLUMN "completion", DROP
+-- COLUMN "checkout_offering"; (the CHECKs go with them).
+
+-- AlterTable
+ALTER TABLE "flow_definitions" ADD COLUMN     "completion" VARCHAR(16) NOT NULL DEFAULT 'lead',
+ADD COLUMN     "checkout_offering" VARCHAR(40);
+
+-- A magnet completes as a lead, an invite or a checkout, nothing else.
+ALTER TABLE "flow_definitions" ADD CONSTRAINT "flow_definitions_completion_domain"
+  CHECK ("completion" IN ('lead', 'invite', 'checkout')) NOT VALID;
+ALTER TABLE "flow_definitions" VALIDATE CONSTRAINT "flow_definitions_completion_domain";
+
+-- An offering is named exactly when the magnet continues to checkout.
+ALTER TABLE "flow_definitions" ADD CONSTRAINT "flow_definitions_checkout_offering_pair"
+  CHECK (("completion" = 'checkout') = ("checkout_offering" IS NOT NULL)) NOT VALID;
+ALTER TABLE "flow_definitions" VALIDATE CONSTRAINT "flow_definitions_checkout_offering_pair";
+
+-- An offering key the spoke checkout route can serve.
+ALTER TABLE "flow_definitions" ADD CONSTRAINT "flow_definitions_checkout_offering_format"
+  CHECK ("checkout_offering" IS NULL OR "checkout_offering" ~ '^[a-z0-9][a-z0-9-]{0,39}$') NOT VALID;
+ALTER TABLE "flow_definitions" VALIDATE CONSTRAINT "flow_definitions_checkout_offering_format";
+
+-- BEGIN completion backfill
+UPDATE "flow_definitions" SET "completion" = 'invite'
+  WHERE "slug" IN ('onboarding', 'request-quote', 'job-application');
+-- END completion backfill

package/templates/database/migrations/20261019120000_consent_source_checkout/migration.sql

@@ -0,0 +1,27 @@
+-- #8765 — a `checkout` consent source (spec
+-- docs/specs/8765-sign-up-refuses-without-the-spec.md D13).
+--
+--   consent_grants — the source vocabulary gains `checkout`: the buyer's
+--                    terms box on a Stripe Checkout session, recorded by the
+--                    hub webhook against the buyer's Person (D14).
+--
+-- DDL only. The CHECK is replaced, never relaxed: the old one is dropped and
+-- the new one, the seven existing values plus `checkout`, is added NOT VALID
+-- and then VALIDATEd, so every existing row is checked against it. No row is
+-- written, and the append-only triggers do not fire on DDL.
+--
+-- The source vocabulary is packages/validation CONSENT_SOURCES.
+--
+-- Rollout: deploy this migration BEFORE the API code that writes a
+-- `checkout` row; the webhook's insert otherwise fails the CHECK (it never
+-- throws, so the order still completes, but no grant is recorded).
+--
+-- Rollback: ALTER TABLE "consent_grants" DROP CONSTRAINT
+-- "consent_grants_source_known"; then re-add it with the seven values of
+-- 20261014120000_consent_ledger — which fails while any `checkout` row
+-- exists, and the ledger is append-only.
+
+ALTER TABLE "consent_grants" DROP CONSTRAINT "consent_grants_source_known";
+ALTER TABLE "consent_grants" ADD CONSTRAINT "consent_grants_source_known"
+  CHECK ("source" IN ('cookie_banner', 'sign_up', 'magnet', 'account_settings', 'email_unsubscribe', 'api', 'legacy', 'checkout')) NOT VALID;
+ALTER TABLE "consent_grants" VALIDATE CONSTRAINT "consent_grants_source_known";

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.42.0",
+  "version": "0.43.0",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"

package/templates/database/seed.ts

@@ -30,6 +30,10 @@ import {
   CONTACT_FORM_FLOW_TITLE,
   CONTACT_FORM_LANDING_PAGE,
   contactFormFlowConfig,
+  JOB_APPLICATION_FLOW_SLUG,
+  JOB_APPLICATION_FLOW_TITLE,
+  JOB_APPLICATION_LANDING_PAGE,
+  jobApplicationFlowConfig,
   REQUEST_QUOTE_FLOW_SLUG,
   REQUEST_QUOTE_FLOW_TITLE,
   requestQuoteFlowConfig,
@@ -79,9 +83,12 @@ export type DefaultWorkspacePrismaClient = Pick<
  * workspace's magnet comes from. Insert-if-absent: an `upsert` with an empty
  * `update`, so an existing `(site_id, slug)` row is never overwritten.
  *
- * #8661 D3 — and its live Contact form magnet, the same way. An existing
- * deployment (a workspace already present) gets its row from the seed-presets
- * CLI instead.
+ * #8661 D3 — and its live Contact form magnet, the same way, and (#8746 D3)
+ * its live Job application magnet. An existing deployment (a workspace
+ * already present) gets its rows from the seed-presets CLI instead.
+ *
+ * #8759 — each names its #8757 D2 completion: the migration's backfill ran
+ * before this seed and found no rows, so the seed writes the value itself.
  */
 export async function provisionDefaultWorkspace(
   prisma: DefaultWorkspacePrismaClient,
@@ -133,6 +140,7 @@ export async function provisionDefaultWorkspace(
       title: REQUEST_QUOTE_FLOW_TITLE,
       status: "draft",
       customersEnabled: true,
+      completion: "invite",
     },
     update: {},
   });
@@ -153,11 +161,34 @@ export async function provisionDefaultWorkspace(
       title: CONTACT_FORM_FLOW_TITLE,
       status: "live",
       customersEnabled: false,
+      completion: "lead",
       landingPage: CONTACT_FORM_LANDING_PAGE,
     },
     update: {},
   });
 
+  await prisma.flowDefinition.upsert({
+    where: {
+      siteId_slug: {
+        siteId: DEFAULT_WORKSPACE_ID,
+        slug: JOB_APPLICATION_FLOW_SLUG,
+      },
+    },
+    create: {
+      siteId: DEFAULT_WORKSPACE_ID,
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      slug: JOB_APPLICATION_FLOW_SLUG,
+      config: jobApplicationFlowConfig,
+      kind: "diagnostic",
+      title: JOB_APPLICATION_FLOW_TITLE,
+      status: "live",
+      customersEnabled: false,
+      completion: "invite",
+      landingPage: JOB_APPLICATION_LANDING_PAGE,
+    },
+    update: {},
+  });
+
   return { created: true };
 }
 

package/versions.json

@@ -1,53 +1,53 @@
 {
-  "@working-theory/admin-ui": "0.42.0",
-  "@working-theory/aeo": "0.42.0",
-  "@working-theory/agent-context": "0.42.0",
+  "@working-theory/admin-ui": "0.43.0",
+  "@working-theory/aeo": "0.43.0",
+  "@working-theory/agent-context": "0.43.0",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.42.0",
-  "@working-theory/api-client": "0.42.0",
+  "@working-theory/analytics": "0.43.0",
+  "@working-theory/api-client": "0.43.0",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.42.0",
-  "@working-theory/common": "0.42.0",
+  "@working-theory/cli": "0.43.0",
+  "@working-theory/common": "0.43.0",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.42.0",
-  "@working-theory/content-projection": "0.42.0",
-  "@working-theory/email": "0.42.0",
+  "@working-theory/content-adapters": "0.43.0",
+  "@working-theory/content-projection": "0.43.0",
+  "@working-theory/email": "0.43.0",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.42.0",
-  "@working-theory/fumadocs-schema": "0.42.0",
+  "@working-theory/eslint-config": "0.43.0",
+  "@working-theory/fumadocs-schema": "0.43.0",
   "@working-theory/ids": "0.14.0",
-  "@working-theory/jsonld": "0.42.0",
-  "@working-theory/license": "0.42.0",
-  "@working-theory/metadata": "0.42.0",
-  "@working-theory/observability": "0.42.0",
-  "@working-theory/page-renderer": "0.42.0",
+  "@working-theory/jsonld": "0.43.0",
+  "@working-theory/license": "0.43.0",
+  "@working-theory/metadata": "0.43.0",
+  "@working-theory/observability": "0.43.0",
+  "@working-theory/page-renderer": "0.43.0",
   "@working-theory/plugin-mcp": "0.1.3",
-  "@working-theory/schema": "0.42.0",
-  "@working-theory/schema-pack-registry": "0.42.0",
-  "@working-theory/schema-validator": "0.42.0",
-  "@working-theory/sections-registry": "0.42.0",
-  "@working-theory/site-config": "0.42.0",
-  "@working-theory/spoke-checkout": "0.5.3",
-  "@working-theory/stripe-client": "0.42.0",
-  "@working-theory/templates": "0.42.0",
-  "@working-theory/theme": "0.42.0",
-  "@working-theory/ui": "0.42.0",
-  "@working-theory/validation": "0.42.0",
-  "@working-theory/web-i18n": "0.42.0",
+  "@working-theory/schema": "0.43.0",
+  "@working-theory/schema-pack-registry": "0.43.0",
+  "@working-theory/schema-validator": "0.43.0",
+  "@working-theory/sections-registry": "0.43.0",
+  "@working-theory/site-config": "0.43.0",
+  "@working-theory/spoke-checkout": "0.6.0",
+  "@working-theory/stripe-client": "0.43.0",
+  "@working-theory/templates": "0.43.0",
+  "@working-theory/theme": "0.43.0",
+  "@working-theory/ui": "0.43.0",
+  "@working-theory/validation": "0.43.0",
+  "@working-theory/web-i18n": "0.43.0",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.20",
-  "@working-theory/ui-docs-blog": "0.23.20",
-  "@working-theory/ui-scheduling": "0.24.0",
-  "@working-theory/ui-signal-collectors": "0.25.9",
+  "@working-theory/ui-commerce": "0.23.21",
+  "@working-theory/ui-docs-blog": "0.23.21",
+  "@working-theory/ui-scheduling": "0.24.1",
+  "@working-theory/ui-signal-collectors": "0.26.0",
   "@working-theory/web": "0.0.0",
   "@working-theory/api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.42.0"
+  "@working-theory/database": "0.43.0"
 }

package/templates/apps/web/app/[locale]/(auth)/sign-up/sign-up.actions.ts

@@ -1,125 +0,0 @@
-"use server";
-
-/**
- * sign-up.actions.ts — mints the sign-up card's carried-agreement cookie
- * (#8438 D13, spec
- * docs/specs/8438-consent-registry-and-ledger-step-spec.md C6).
- *
- * `apps/web` never touches the database (the ledger writer is `apps/api`),
- * and Better Auth creates the user from THIS app before any Person exists to
- * record a grant against. So the card remembers which agreements the person
- * ticked, in a short-lived, signed, email-bound cookie — the account home's
- * first signed-in visit (`(authed)/account/actions.ts`'s
- * `acceptCarriedAgreementsAction`) consumes it, one write per agreement,
- * then deletes it either way (single-use).
- *
- * The CONSUME side lives in the account area, not here, deliberately:
- * `(auth)/**` is one of the sign-in seeds a sign-in-less spoke drops
- * (`SPOKE_REMOVAL_SEEDS`, `packages/create-ailk/src/topology.ts` D4), so a
- * file OUTSIDE `(auth)` (the account home's `agreements-prompt.tsx`) must
- * never import FROM here — doing so once failed the scaffolder's own
- * dangling-import check (`spokeExclusions`) for exactly this reason. This
- * file is reached only from `sign-up-card.tsx`, its own directory sibling,
- * so it carries no such obligation. The two files duplicate the small
- * cookie codec (encode here, decode there) rather than share a module,
- * precisely so each side's dependencies stay native to where it lives.
- *
- * Cookie value: `<id>@<version>,…|<issuedAtMs>|<sha256(lowercased email)>|
- * <HMAC-SHA256 over the rest>`, keyed by `BETTER_AUTH_SECRET` — the same
- * dev fallback `apps/web/auth.ts`'s own `resolveSecret()` publishes when it
- * is unset; production refuses to mint without one. That secret is read
- * directly HERE rather than importing `resolveSecret` from `auth.ts`: that
- * module statically imports the `better-auth` ESM package, which every
- * broad page-level test suite that renders `/sign-up` would then have to
- * add to its `../../../../auth` mock. `__Host-` prefixed, httpOnly,
- * `Secure`, one hour, `SameSite=Lax` — the `__Host-` prefix needs `Secure`,
- * so development over plain `http://localhost` uses the unprefixed name
- * instead (SEC-8438-5).
- */
-
-import { createHash, createHmac } from "node:crypto";
-
-import { consentPurposeById, SITE_CONSENT_CONFIG_DEFAULTS } from "@working-theory/validation";
-import { cookies } from "next/headers";
-
-const SECURE_COOKIE_NAME = "__Host-ailk-signup-agreements";
-const DEV_COOKIE_NAME = "ailk-signup-agreements";
-const MAX_AGE_SECONDS = 60 * 60;
-
-/** The string `auth.ts`'s own `resolveSecret()` publishes — see file header. */
-const DEV_FALLBACK_SECRET =
-  "ailk-dev-fallback-secret-published-in-this-repo-never-use-in-production";
-
-/** Mirrors `auth.ts`'s `resolveSecret()` exactly, without importing it. */
-function signUpAgreementsSecret(): string {
-  const configured = process.env.BETTER_AUTH_SECRET;
-  if (configured) return configured;
-  const isBuildPhase = process.env.NEXT_PHASE === "phase-production-build";
-  if (process.env.NODE_ENV === "production" && !isBuildPhase) {
-    throw new Error(
-      "BETTER_AUTH_SECRET is required in production: it signs the carried sign-up-agreement cookie.",
-    );
-  }
-  return DEV_FALLBACK_SECRET;
-}
-
-function cookieName(): string {
-  return process.env.NODE_ENV === "production" ? SECURE_COOKIE_NAME : DEV_COOKIE_NAME;
-}
-
-function emailHash(email: string): string {
-  return createHash("sha256").update(email.trim().toLowerCase()).digest("hex");
-}
-
-function sign(payload: string): string {
-  return createHmac("sha256", signUpAgreementsSecret()).update(payload).digest("hex");
-}
-
-interface CarriedPurpose {
-  id: string;
-  version: number;
-}
-
-function encodeCarriedAgreements(
-  purposes: CarriedPurpose[],
-  email: string,
-  issuedAtMs: number,
-): string {
-  const purposesPart = purposes.map((p) => `${p.id}@${p.version}`).join(",");
-  const payload = `${purposesPart}|${issuedAtMs}|${emailHash(email)}`;
-  return `${payload}|${sign(payload)}`;
-}
-
-/**
- * Mints the carried-agreement cookie from the ticked `signUp` agreements,
- * read back from the registry for their CURRENT version — never trusting a
- * version the client might assert. Purposes the registry no longer marks
- * `signUp` are dropped. Never throws: a failed mint just means the account
- * home's first visit asks explicitly instead (D13's "Otherwise" card).
- */
-export async function rememberSignUpAgreementsAction(
-  email: string,
-  purposeIds: string[],
-): Promise<void> {
-  try {
-    const config = SITE_CONSENT_CONFIG_DEFAULTS;
-    const purposes: CarriedPurpose[] = [];
-    for (const id of purposeIds) {
-      const purpose = consentPurposeById(config, id);
-      if (purpose?.signUp) purposes.push({ id: purpose.id, version: purpose.policyVersion });
-    }
-    if (purposes.length === 0) return;
-
-    const value = encodeCarriedAgreements(purposes, email, Date.now());
-    const cookieStore = await cookies();
-    cookieStore.set(cookieName(), value, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === "production",
-      sameSite: "lax",
-      path: "/",
-      maxAge: MAX_AGE_SECONDS,
-    });
-  } catch {
-    // Convenience only — see file header.
-  }
-}