create-ailk 0.24.0 → 0.26.0

package/templates/apps/mcp/src/app.ts

@@ -10,23 +10,24 @@
  * warm instance reuses the booted app.
  *
  * Run locally, use `src/index.ts` (stdio, or HTTP on MCP_HTTP_PORT) instead.
- * Everything testable lives in `serverless-app.ts`.
+ * Everything testable lives in `@working-theory/mcp-server` (#9460).
  */
 
-import Fastify from "fastify";
-
-import { bootMcp } from "./boot.js";
 import {
+  bootMcp,
   configureServerlessApp,
   SERVERLESS_FASTIFY_OPTIONS,
   serverlessHandler,
-} from "./serverless-app.js";
+} from "@working-theory/mcp-server";
+import Fastify from "fastify";
+
+import { site } from "./site.js";
 
 /** Read statically by Vercel's Node builder; caps one request (S8070-03). */
 export const config = { maxDuration: 30 };
 
-await bootMcp();
+await bootMcp(site);
 const app = Fastify(SERVERLESS_FASTIFY_OPTIONS);
-await configureServerlessApp(app);
+await configureServerlessApp(app, site);
 await app.ready();
 export default serverlessHandler(app);

package/templates/apps/mcp/src/index.ts

@@ -23,41 +23,13 @@
  *   CONTENT_ADAPTER=mdx|projection|database
  *   DATABASE_URL=  (required only when CONTENT_ADAPTER=database)
  *
- * The boot sequence and the HTTP env reading live in `boot.ts`, shared with
- * the Vercel entry `app.ts` (#8070 D2).
+ * The server is `@working-theory/mcp-server` (#9460): the boot sequence, the
+ * transports and every tool come from the package, so a version bump of it is
+ * the whole of taking an MCP change. This file hands it the site.
  */
 
-import {
-  bootMcp,
-  httpTransportConfigFromEnv,
-  readStatelessEnv,
-} from "./boot.js";
+import { runMcp } from "@working-theory/mcp-server";
 
-// The workspace, the licence-key store, the commerce claim, its re-read loop
-// and the licence boot warning — before either transport branch below.
-await bootMcp();
+import { site } from "./site.js";
 
-const transport = process.env["MCP_TRANSPORT"] ?? "stdio";
-
-if (transport === "http") {
-  const { startHttpTransport } = await import("./http-transport.js");
-
-  const config = httpTransportConfigFromEnv();
-  await startHttpTransport({
-    ...config,
-    stateless: readStatelessEnv(false),
-  });
-
-  console.log(
-    `MCP HTTP transport listening on port ${config.port} at ${config.path}`,
-  );
-} else {
-  // Default: stdio transport
-  const { StdioServerTransport } =
-    await import("@modelcontextprotocol/sdk/server/stdio.js");
-  const { createMcpServer } = await import("./server.js");
-
-  const server = createMcpServer();
-  const stdioTransport = new StdioServerTransport();
-  await server.connect(stdioTransport);
-}
+await runMcp(site);

package/templates/apps/mcp/src/lib/paid-tools.generated.ts

@@ -0,0 +1,10 @@
+// paid-tools.generated.ts — the paid MCP tool packages this site carries.
+//
+// GENERATED by create-ailk from MODULE_SLICES (`paidMcpToolPackages`) and
+// this app's package.json dependencies (#9460). Do not edit: every scaffold
+// and `create-ailk add-module` rewrites it. A carried package is a bundled
+// dynamic import the server resolves its paid tools from at call time; a
+// site that carries none exports an empty list.
+import type { McpToolPackLoader } from "@working-theory/mcp-server";
+
+export const PAID_TOOL_PACKS: readonly McpToolPackLoader[] = [];

package/templates/apps/mcp/src/lib/topology.generated.ts

@@ -10,9 +10,9 @@ import {
   initMcpPublicWorkspace,
   mcpPublicWorkspace,
   type McpWorkspaceResolution,
-} from "./public-workspace.js";
+} from "@working-theory/mcp-server/hub";
 
-export { registerLicenseKeyStore } from "./license-key-store.js";
+export { registerLicenseKeyStore } from "@working-theory/mcp-server/hub";
 export type { McpWorkspaceResolution };
 
 export const TOPOLOGY: "hub" | "spoke" = "hub";

package/templates/apps/mcp/src/site.ts

@@ -0,0 +1,12 @@
+/**
+ * The site this MCP server runs for (#9460 DD2/DD4): the topology seam and
+ * the paid-tool registry, both generated by create-ailk, handed to
+ * `@working-theory/mcp-server` as one object. Nothing else is the site's own.
+ */
+
+import type { McpSite } from "@working-theory/mcp-server";
+
+import { PAID_TOOL_PACKS } from "./lib/paid-tools.generated.js";
+import * as topology from "./lib/topology.generated.js";
+
+export const site: McpSite = { topology, paidToolPacks: PAID_TOOL_PACKS };

package/templates/apps/web/.env.example

@@ -229,7 +229,7 @@ CONTENT_ADAPTER=mdx
 # AILK_HUB_SIGN_IN_URL=https://hub.example.com
 #
 # This site's client id and secret, issued on the hub with
-#   pnpm --filter @working-theory/api spokes sign-in-client --id <spoke_id> \
+#   pnpm --filter @working-theory/app-api spokes sign-in-client --id <spoke_id> \
 #     --redirect-uri <this site's origin>/api/hub-session/callback
 # The client id is the spoke's id. The secret is shown once; keep it out of git.
 # AILK_HUB_CLIENT_ID=

package/templates/apps/web/CLAUDE.md

@@ -130,6 +130,25 @@ older hub's 404). The carried `__Host-ailk-signup-agreements` cookie is
 retired. Policy links on every agreement surface come from
 `lib/consent-policies.ts`'s `consentPoliciesFor(locale)`.
 
+**A magic link can create the account while sign-up is open (#9667).** With
+the email sign-in link on, an open `/sign-up` is the one-field "Send me a
+magic link" body (the page's method is `magic-link` before `password`), and
+the card POSTs `/api/auth/sign-in/magic-link` with the ticked agreements and
+locale in `metadata`. A request carrying that key is a sign-up request: the
+plugin refuses it `400 SIGN_UP_CLOSED` on a closed site and
+`400 AGREEMENTS_REQUIRED` without the agreements, before any lookup; the
+callback binds the accepted agreements to the token (a `verification` row
+keyed on SHA-256 of the token) and mails the address whether or not it has
+an account (`userId: "sign-up"` for a new one). The plugin's
+`disableSignUp` follows `isSignUpOpen()`. On verify, the user hook refuses —
+a redirect to `/sign-up?error=AGREEMENTS_REQUIRED` — a new user whose token
+has no binding or whose binding no longer covers the evidence, and the
+session hook writes the grants in their own transaction before the session
+exists, deleting the user if that write fails. A request with no `metadata`
+(every `/sign-in` one) is a sign-in, unchanged. Not one transaction: a crash
+between the user and grant inserts leaves a user with no grant, whom the
+account interstitial stops.
+
 ## Contact page
 
 The contact page (`apps/web/app/[locale]/contact/page.tsx`) renders the
@@ -407,7 +426,8 @@ Every multi-step magnet is a page pair (#8840), rendered by one module,
   content. With none, #8848 D6 holds for a configured hub: a 5xx or a refused
   connection shows the contact email (`noindex`). A site with no hub to ask —
   the read answers 503 `flows_not_configured`, or no API origin
-  (`AILK_API_URL`, `NEXT_PUBLIC_AILK_API_URL`, `NEXT_PUBLIC_API_URL`) is set —
+  (`AILK_API_URL`, the origin `browserApiOrigin()` returns, or
+  `NEXT_PUBLIC_API_URL`) is set —
   reads `not-configured` (set once in `readMagnet`), and the slug 404s, as
   does its `/start` (#9219). `/downloads` and `/downloads/<slug>` are
   permanent redirects into `/reports` (signal-collectors files).
@@ -426,7 +446,11 @@ key), so the page names none. It renders one of three pages:
 - **Unconnected** — the route answers `unconnected`, or the deployment runs
   in production with none of the API origin variables `getApiBase()` reads:
   today's MDX page through `renderPage`, byte for byte, `?plan=` matching
-  authored plan keys as #8842 made it.
+  authored plan keys as #8842 made it. The browser-facing one is read
+  through `lib/api-origin.generated.ts`'s `browserApiOrigin()` (#7874 D12):
+  `NEXT_PUBLIC_AILK_API_URL` on a hub, nothing on a spoke, which refuses that
+  name — so a spoke with `/pricing` passes its own `env:check` (#9480). The
+  magnet pages and the results permalink read it the same way.
 - **A current shown set** — `lib/offerings-pricing.ts` maps it to a plans
   fragment and an add-ons fragment. The first `pricing` section that is not
   `addons` becomes the Stripe plans, and the first `addons` one the Stripe
@@ -546,7 +570,11 @@ A visitor's browser never calls the hub. Lead capture, newsletter signup, callba
 - Don't reach into `apps/api` or `apps/mcp` from `apps/web`. They're peer apps — talk via HTTP/MCP.
 - Don't commit images to `screenshots/` — only the `.gitkeep` is tracked.
 
-Last updated: 2026-10-20 — § Magnet pages: the trial magnet's pair, `/trial` (its button to `/trial/request` through `renderMagnetLanding`'s `startPath`) and the chrome-free `/trial/request` walk with its own `<h1>` fallback (#9287 C2, DD10) — verified against `app/[locale]/flows/[slug]/magnet-page.tsx`, `app/[locale]/trial/{page,request/page}.tsx` and `lib/magnet-routes.ts`.
+Last updated: 2026-10-24 — § The `(auth)` route group: a magic link can create the account while sign-up is open, carrying the ticked agreements bound to its token (#9667) — verified against `lib/auth-email.ts`, `lib/sign-up-agreements.ts` and `app/[locale]/(auth)/sign-up/{page,sign-up-card}.tsx`.
+
+Prior: 2026-10-21 — § Pricing page and § Magnet pages: `/pricing`, the magnet pages and the results permalink read the browser-facing API origin through `browserApiOrigin()` (#7874 D12), so a spoke that enables them passes its own `env:check` (#9480) — verified against `app/[locale]/pricing/page.tsx`, `app/[locale]/flows/[slug]/{magnet-page.tsx,results/[payload]/page.tsx}` and `lib/api-origin.generated.ts`.
+
+Prior: 2026-10-20 — § Magnet pages: the trial magnet's pair, `/trial` (its button to `/trial/request` through `renderMagnetLanding`'s `startPath`) and the chrome-free `/trial/request` walk with its own `<h1>` fallback (#9287 C2, DD10) — verified against `app/[locale]/flows/[slug]/magnet-page.tsx`, `app/[locale]/trial/{page,request/page}.tsx` and `lib/magnet-routes.ts`.
 
 Prior: 2026-10-19 — § Magnet pages: `/careers/apply` renders the contact email under its own `<h1>` when its flow is absent or the hub cannot answer; `readMagnet`'s `not-configured` kind 404s an unknown `/reports/<slug>` (and its `/start`) on a site with no hub to ask, while a configured hub that is down keeps #8848 D6's contact email (#9219) — verified against `app/[locale]/flows/[slug]/magnet-page.tsx`, `app/[locale]/careers/apply/page.tsx`, `app/[locale]/reports/deliverable-page.tsx` and `app/[locale]/reports/[slug]/{page,start/page}.tsx`.
 

package/templates/apps/web/app/.well-known/mcp.json/route.ts

@@ -16,7 +16,9 @@
  * the surface disagreement `apps/mcp/__tests__/catalog-drift.test.ts` exists
  * to make impossible. The same single read also yields the licence features
  * the deployment holds (#7136), which gate the five `feature`-tagged tools
- * here exactly as they gate registration on the MCP server.
+ * here exactly as they gate registration on the MCP server. `create_project`
+ * is left out while create-ailk's release scope holds the Free level (#9534),
+ * as `apps/mcp` leaves it unregistered — `lib/release-scope.ts`.
  *
  * Mirrors /.well-known/ai-plugin.json conventions: Response.json with a
  * conservative cache-control header.
@@ -26,6 +28,7 @@
  * is appropriate per the MCP discovery spec.
  */
 
+import { isFreeLevelReleased } from "../../../lib/release-scope";
 import { UNSERVED_MCP_TOOLS } from "../../../lib/topology.generated";
 import packageJson from "../../../package.json";
 import {
@@ -60,8 +63,11 @@ export async function GET(): Promise<Response> {
     ailkVersion: packageJson.version,
     commerceClaimed: heldFeatures.includes(COMMERCE_FEATURE),
     heldFeatures,
-    // The tools this topology's MCP server does not register (#8070 D7).
-    unservedTools: UNSERVED_MCP_TOOLS,
+    // The tools this topology's MCP server does not register (#8070 D7) —
+    // and create_project while the Free level is held (#9534).
+    unservedTools: isFreeLevelReleased()
+      ? UNSERVED_MCP_TOOLS
+      : [...UNSERVED_MCP_TOOLS, "create_project"],
     // Spread conditional to satisfy exactOptionalPropertyTypes: omit the key
     // entirely when the env var is not set rather than passing undefined.
     ...(mcpHttpUrlEnv ? { mcpHttpUrl: mcpHttpUrlEnv } : {}),

package/templates/apps/web/app/[locale]/(auth)/__tests__/auth-pages.test.tsx

@@ -17,7 +17,7 @@
  * `next-intl/server` is mocked globally (apps/web/__tests__/setup.ts) against
  * the real en.json, so the `auth` copy is asserted by its real strings.
  */
-import { render, screen } from "@testing-library/react";
+import { render, screen, within } from "@testing-library/react";
 
 const mockGetActiveProviderIds = jest.fn();
 const mockIsSignUpOpen = jest.fn();
@@ -217,12 +217,51 @@ describe("/sign-up follows isSignUpOpen()", () => {
   it("renders the invitation intent when sign-up is closed", async () => {
     mockIsSignUpOpen.mockReturnValue(false);
     await renderPage(SignUpPage);
-    expect(screen.getByTestId("auth-invitation-body")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-invitation-body")).toHaveTextContent(
+      en.auth.invitationBody,
+    );
     expect(
-      screen.getByRole("heading", { name: en.auth.invitationHeading }),
+      screen.getByRole("heading", { name: en.auth.signUpHeading }),
     ).toBeInTheDocument();
     expect(screen.queryByTestId("auth-submit")).not.toBeInTheDocument();
   });
+
+  // The one card (#9662) frames both branches: the mark, "Sign up", the toggle
+  // line to /sign-in (no footer cross-link) and the acknowledgement.
+  it.each([
+    ["closed", false],
+    ["open", true],
+  ] as const)("frames the %s card: mark, 'Sign up', toggle line, footnote (#9662)", async (_name, open) => {
+    mockIsSignUpOpen.mockReturnValue(open);
+    mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+    await renderPage(SignUpPage);
+    expect(screen.getByTestId("auth-card-logo")).toBeInTheDocument();
+    expect(screen.getByRole("heading", { name: "Sign up" })).toBeInTheDocument();
+    expect(screen.getByTestId("auth-card-prospect")).toHaveTextContent(
+      /^Already have an account\? Sign in$/,
+    );
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/sign-in",
+    );
+    expect(screen.queryByTestId("auth-footer-link")).not.toBeInTheDocument();
+    expect(screen.getByTestId("auth-card-footnote")).toHaveTextContent(
+      /^You acknowledge that you read, and agree to our Terms of Service and our Privacy Policy\.$/,
+    );
+    const footnote = within(screen.getByTestId("auth-card-footnote"));
+    expect(footnote.getByRole("link", { name: "Terms of Service" })).toHaveAttribute("href", "/terms");
+    expect(footnote.getByRole("link", { name: "Privacy Policy" })).toHaveAttribute("href", "/privacy");
+  });
+
+  it("offers 'or' + Google under the open card's form, with the consent checkboxes kept (#9662; #8438 D13)", async () => {
+    mockIsSignUpOpen.mockReturnValue(true);
+    mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+    await renderPage(SignUpPage);
+    expect(screen.getByLabelText("Email")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-divider")).toHaveTextContent(/^or$/);
+    expect(screen.getByTestId("auth-social-google")).toBeInTheDocument();
+    expect(screen.getByTestId("sign-up-agreements")).toBeInTheDocument();
+  });
 });
 
 describe("/forgot-password and /reset-password follow the reset predicate", () => {
@@ -266,9 +305,9 @@ describe("/forgot-password and /reset-password follow the reset predicate", () =
 
 // ── Every non-form page routes back to sign-in ───────────────────────────────
 
+// A closed /sign-up routes back through its toggle line instead (#9662, above).
 describe("the copy-only intents route back to sign-in", () => {
   it.each([
-    ["sign-up (closed)", SignUpPage],
     ["forgot-password (unavailable)", ForgotPasswordPage],
     ["reset-password (unavailable)", ResetPasswordPage],
     ["verify-email", VerifyEmailPage],

package/templates/apps/web/app/[locale]/(auth)/legal-footnote.tsx

@@ -0,0 +1,35 @@
+/**
+ * The acknowledgement at the foot of every auth card (#8790 D6) — "You
+ * acknowledge that you read, and agree to our Terms of Service and our Privacy
+ * Policy." (#9662) — linking the site's own policy routes through the inline
+ * link variant, so the card never hardcodes a path.
+ *
+ * One builder for `/sign-in`, `/sign-up` and the `(authed)` gate.
+ * `caption` is the muted footnote role; a default `Text` would re-impose body
+ * size and the foreground colour over the card's footnote wrapper.
+ */
+
+import { localeHref } from "@working-theory/ui";
+import { Link, Text } from "@working-theory/ui/primitives";
+import type { ReactElement } from "react";
+
+import type { SignInCardText } from "./sign-in/sign-in-text";
+
+export function legalFootnote(
+  locale: string,
+  text: SignInCardText["acknowledgement"],
+): ReactElement {
+  return (
+    <Text as="p" variant="caption">
+      {text.lead}{" "}
+      <Link variant="inline" href={localeHref(locale, "/terms")}>
+        {text.terms}
+      </Link>{" "}
+      {text.and}{" "}
+      <Link variant="inline" href={localeHref(locale, "/privacy")}>
+        {text.privacy}
+      </Link>
+      {text.end}
+    </Text>
+  );
+}

package/templates/apps/web/app/[locale]/(auth)/sign-in/__tests__/page.test.tsx

@@ -24,11 +24,16 @@
  *   (i) the hinted email (#8757 D9): a valid single `?email=` is the starting
  *       value of every email input of the card; an invalid or repeated value,
  *       or none, leaves them empty as before. It signs no one in.
+ *   (j) the one card (#9662): the site's logo and "Sign in to <site>" from
+ *       the deployment's own data — a crafted query parameter cannot change
+ *       the name — the "Don't have an account? Sign up" line linking
+ *       /sign-up, and the Terms + Privacy acknowledgement.
  *
- * `next-intl/server` is mocked globally (apps/web/__tests__/setup.ts) against
- * the real en.json, so `signIn` copy is asserted by its real strings.
+ * `next-intl/server` is mocked here against the real en.json, with `{name}`
+ * placeholders filled from the values passed, so `signIn` copy is asserted
+ * by its real strings and the heading by the name actually interpolated.
  */
-import { render, screen } from "@testing-library/react";
+import { render, screen, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 
 const mockGetActiveProviderIds = jest.fn();
@@ -75,7 +80,31 @@ jest.mock("@working-theory/api-client", () => ({
   __esModule: true,
   hubSignIn: { clientInfo: (...args: unknown[]) => mockClientInfo(...args) },
 }));
+// The global shim (__tests__/__mocks__/next-intl-server.ts) returns messages
+// uninterpolated; this suite fills `{name}` placeholders so the heading's
+// organization name is the one the page actually passed (#9662).
+jest.mock("next-intl/server", () => {
+  const messages = jest.requireActual("../../../../../messages/en.json") as Record<
+    string,
+    Record<string, string>
+  >;
+  return {
+    __esModule: true,
+    getTranslations: async ({ namespace }: { namespace: string }) => {
+      const catalog = messages[namespace];
+      const t = (key: string, values?: Record<string, string>): string =>
+        (catalog?.[key] ?? `${namespace}.${key}`).replace(
+          /\{(\w+)\}/g,
+          (match, name: string) => values?.[name] ?? match,
+        );
+      t.has = (key: string): boolean => catalog?.[key] !== undefined;
+      return t;
+    },
+  };
+});
+
 import { mintContinuation } from "../../../../api/auth/hub/continuation";
+import { SITE_NAME } from "../../../../../lib/site-brand";
 import en from "../../../../../messages/en.json";
 import Page, { generateMetadata } from "../page";
 
@@ -119,7 +148,9 @@ describe("/sign-in page", () => {
     expect(screen.queryByTestId("auth-submit")).toBeNull();
     expect(screen.queryByTestId("auth-footer-link")).toBeNull();
     expect(screen.queryByText(/create an account/i)).toBeNull();
-    expect(screen.getByText(en.signIn.heading)).toBeInTheDocument();
+    expect(
+      screen.getByRole("heading", { name: `Sign in to ${SITE_NAME}` }),
+    ).toBeInTheDocument();
   });
 
   it("(b) email + OAuth: password body with both social buttons, no sign-up footer", async () => {
@@ -241,7 +272,7 @@ describe("/sign-in page — the email sign-in link (#7435)", () => {
     expect(screen.getByTestId("auth-submit")).toHaveTextContent(
       en.signIn.emailLinkSubmit,
     );
-    expect(en.signIn.emailLinkSubmit).toBe("Email me a sign-in link");
+    expect(en.signIn.emailLinkSubmit).toBe("Send me a magic link");
     // One "or" divider between the primary and Google (#8790 D5).
     expect(screen.getAllByTestId("auth-divider")).toHaveLength(1);
     expect(screen.queryByTestId("auth-email-link-divider")).toBeNull();
@@ -252,9 +283,11 @@ describe("/sign-in page — the email sign-in link (#7435)", () => {
     await renderPage();
     expect(screen.getByTestId("auth-email")).toBeInTheDocument();
     expect(screen.queryByText(en.signIn.notConfiguredSubhead)).toBeNull();
-    // "Welcome back" stands alone — no subhead (#8790 D3).
-    expect(screen.getByText(en.signIn.heading)).toBeInTheDocument();
-    expect(en.signIn.heading).toBe("Welcome back");
+    // The heading stands alone — no subhead (#8790 D3); #9662 names the site.
+    expect(
+      screen.getByRole("heading", { name: `Sign in to ${SITE_NAME}` }),
+    ).toBeInTheDocument();
+    expect(en.signIn.heading).toBe("Sign in to {site}");
     expect(screen.queryByTestId("auth-method-switch")).toBeNull();
   });
 
@@ -415,3 +448,79 @@ describe("/sign-in page — the hinted email (#8757 D9)", () => {
     },
   );
 });
+
+describe("/sign-in page — the one card (#9662)", () => {
+  beforeEach(() => {
+    mockGetActiveProviderIds.mockReturnValue(["google", "email", "magic-link"]);
+  });
+
+  it("(j) renders the site's logo and 'Sign in to <site>' from the deployment's data", async () => {
+    await renderPage("/account");
+    expect(screen.getByTestId("auth-card-logo")).toBeInTheDocument();
+    expect(screen.getByRole("heading", { level: 2 })).toHaveTextContent(
+      `Sign in to ${SITE_NAME}`,
+    );
+    expect(screen.getByLabelText(en.signIn.email)).toBe(
+      screen.getByTestId("auth-email"),
+    );
+    expect(en.signIn.email).toBe("Email");
+  });
+
+  it("(j) a crafted query parameter cannot change the organization name", async () => {
+    const crafted = "Evil Corp";
+    expect(SITE_NAME).not.toBe(crafted);
+    const el = await Page({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve({
+        next: `/account?site=${encodeURIComponent(crafted)}`,
+        site: crafted,
+        organization: crafted,
+        name: crafted,
+        siteName: crafted,
+      }),
+    });
+    render(el);
+    expect(screen.getByRole("heading", { level: 2 })).toHaveTextContent(
+      `Sign in to ${SITE_NAME}`,
+    );
+    expect(document.body.textContent).not.toContain(crafted);
+  });
+
+  it("(j) the prospect line toggles to /sign-up, with no trailing period", async () => {
+    await renderPage("/account");
+    expect(screen.getByTestId("auth-card-prospect")).toHaveTextContent(
+      /^Don't have an account\? Sign up$/,
+    );
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/sign-up",
+    );
+  });
+
+  it("(j) 'Send me a magic link' first, the in-place password switch, then 'or' and Google", async () => {
+    await renderPage("/account");
+    expect(screen.getByTestId("auth-submit")).toHaveTextContent(
+      "Send me a magic link",
+    );
+    expect(screen.getByTestId("auth-method-switch")).toHaveTextContent(
+      "Sign in using password",
+    );
+    expect(screen.getByTestId("auth-divider")).toHaveTextContent(/^or$/);
+    expect(screen.getByTestId("auth-social-google")).toBeInTheDocument();
+  });
+
+  it("(j) ends on the Terms of Service + Privacy Policy acknowledgement, linking the site's own routes", async () => {
+    await renderPage("/account");
+    const footnote = screen.getByTestId("auth-card-footnote");
+    expect(footnote).toHaveTextContent(
+      /^You acknowledge that you read, and agree to our Terms of Service and our Privacy Policy\.$/,
+    );
+    expect(
+      within(footnote).getByRole("link", { name: "Terms of Service" }),
+    ).toHaveAttribute("href", "/terms");
+    expect(
+      within(footnote).getByRole("link", { name: "Privacy Policy" }),
+    ).toHaveAttribute("href", "/privacy");
+    expect(within(footnote).getAllByRole("link")).toHaveLength(2);
+  });
+});

package/templates/apps/web/app/[locale]/(auth)/sign-in/page.tsx

@@ -18,14 +18,19 @@
  *
  * Since #5963 the page lives in the `(auth)` route group — the URL is
  * unchanged (a group contributes no path segment) but the frame is
- * `AuthShell`, not the marketing Nav + Footer. The shell owns the brand mark
- * and the 400px column, so this page passes NO `logo` (it would render twice)
- * and no framing of its own.
+ * `AuthShell`, not the marketing Nav + Footer. The shell owns the 400px
+ * column; the card carries the site's mark (#8790 D3).
+ *
+ * The one card (#9662): "Sign in to <site>" (the name is the deployment's,
+ * read in `resolveSignInCardText`, never the request's), the "Don't have an
+ * account? Sign up" line to `/sign-up`, and the Terms + Privacy
+ * acknowledgement.
  *
  * Signed-in visitors are not redirected here — the Nav's session-aware action
  * cluster (Account / Sign out) is the affordance for them.
  */
 
+import { hubSignIn } from "@working-theory/api-client";
 import { localeHref } from "@working-theory/ui";
 import { accountEmailHintSchema } from "@working-theory/validation";
 import type { Metadata } from "next";
@@ -36,14 +41,13 @@ import {
   getActiveProviderIds,
   resetSendConfigured,
 } from "../../../../lib/auth-env";
-
-import { hubSignIn } from "@working-theory/api-client";
-import { Link, Text } from "@working-theory/ui/primitives";
 import { siteLogo } from "../../../../lib/site-logo";
 import {
   CONTINUE_PATH,
   openContinuation,
 } from "../../../api/auth/hub/continuation";
+import { legalFootnote } from "../legal-footnote";
+
 import { resolveNextPath } from "./next-path";
 import { SignInCard, type SignInProvider } from "./sign-in-card";
 import { resolveSignInCardText, type SignInCardText } from "./sign-in-text";
@@ -151,27 +155,7 @@ export default async function SignInPage({
   const defaultEmail = hintedEmail(rawEmail);
 
   const spoke = await spokeFromNext(next);
-  // The acknowledgement (#8790 D6) — the hub's own policy pages, through the
-  // inline link variant; the card never hardcodes a path.
-  // `caption` is the muted footnote role; a default `Text` would re-impose
-  // body size and the foreground colour over the card's footnote wrapper.
-  const footnote = (
-    <Text as="p" variant="caption">
-      {text.acknowledgement.lead}{" "}
-      <Link variant="inline" href={localeHref(locale, "/terms")}>
-        {text.acknowledgement.terms}
-      </Link>
-      ,{" "}
-      <Link variant="inline" href={localeHref(locale, "/privacy")}>
-        {text.acknowledgement.privacy}
-      </Link>
-      , and{" "}
-      <Link variant="inline" href={localeHref(locale, "/working-agreement")}>
-        {text.acknowledgement.workingAgreement}
-      </Link>
-      .
-    </Text>
-  );
+  const t = await getTranslations({ locale, namespace: "signIn" });
   return (
     <SignInCard
       logo={siteLogo()}
@@ -179,19 +163,12 @@ export default async function SignInPage({
         ? {
             backLink: {
               href: `${spoke.origin}/account`,
-              label: text.backTo(spoke.name),
-            },
-          }
-        : {})}
-      {...(text.prospect
-        ? {
-            prospect: {
-              ...text.prospect,
-              href: localeHref(locale, "/sign-up"),
+              label: t("backTo", { site: spoke.name }),
             },
           }
         : {})}
-      footnote={footnote}
+      prospect={{ ...text.prospect, href: localeHref(locale, "/sign-up") }}
+      footnote={legalFootnote(locale, text.acknowledgement)}
       providers={providers}
       method={method}
       next={next}

package/templates/apps/web/app/[locale]/(auth)/sign-in/sign-in-card.tsx

@@ -11,12 +11,12 @@
  * method from auth-env and hands them in; this component never reads env
  * itself.
  *
- * The brand mark is the SHELL's since #5963 — this island renders no `logo`,
- * or it would appear twice on the page.
+ * The site's mark arrives as `logo` (#8790 D3) and renders centred in the
+ * card; the shell draws no brand row.
  *
- * No sign-up affordance anywhere: `footer="none"` drops the "Not a member?
- * Create an account" cross-link (Better Auth `emailAndPassword.disableSignUp`
- * posture).
+ * `footer="none"` drops AuthCard's "Not a member? Create an account"
+ * cross-link; the page's `prospect` line ("Don't have an account? Sign up",
+ * #9662) is the one route to `/sign-up`.
  *
  * Password path: `apps/web/auth.ts` does not enable `emailAndPassword` today,
  * so `signIn.email` is wired but inert (Better Auth answers with an error)
@@ -242,7 +242,7 @@ export function SignInCard({
         {...(logo !== undefined ? { logo } : {})}
         {...(forgotHref !== undefined ? { forgotHref } : {})}
         {...(forgot !== undefined ? { forgot } : {})}
-        // "Welcome back" stands alone (#8790 D3): no subhead unless the card
+        // The heading stands alone (#8790 D3): no subhead unless the card
         // is inert and must say why.
         subhead={notConfigured ? notConfiguredSubhead : ""}
         {...(prospect !== undefined ? { prospect } : {})}