create-ailk 0.24.0 → 0.26.0

package/templates/apps/web/app/[locale]/layout.tsx

@@ -952,7 +952,9 @@ export default async function LocaleLayout({
            * cookie read — same #5557 hydration-safety property, no gate
            * needed. This also means the banner never blocks the page: it
            * reserves its own space (D1) and carries a close-without-choosing
-           * control (D2) instead of a hard server-side hide.
+           * control (D2) instead of a hard server-side hide. The standard
+           * chrome's compact card has no close control (#9656 D5): it is a
+           * non-modal corner card and Decline All is one tap.
            */}
           {isAccountRoute ? null : (
             <ConsentBanner
@@ -961,18 +963,36 @@ export default async function LocaleLayout({
               consentCookieName={CONSENT_COOKIE_NAME}
               consentDecided={consentDecided}
               title={tConsent("title")}
-              message={
-                <>
-                  {consentBannerStatement}{" "}
-                  <Link
-                    href={localeHref(locale, "/privacy")}
-                    variant="unstyled"
-                    className="font-semibold text-current underline underline-offset-4"
-                  >
-                    {tConsent("policyLinkLabel")}
-                  </Link>
-                </>
-              }
+              // #9656 D7 — the standard chrome mounts the compact floating
+              // card on every width, its Privacy Policy link on the button
+              // row; the minimal chrome keeps its hairline band (#7742 D5),
+              // the statement with the link inline.
+              {...(isMinimalChrome
+                ? {
+                    message: (
+                      <>
+                        {consentBannerStatement}{" "}
+                        <Link
+                          href={localeHref(locale, "/privacy")}
+                          variant="unstyled"
+                          className="font-semibold text-current underline underline-offset-4"
+                        >
+                          {tConsent("policyLinkLabel")}
+                        </Link>
+                      </>
+                    ),
+                  }
+                : {
+                    message: consentBannerStatement,
+                    presentation: "floating" as const,
+                    corner: "bottom-left" as const,
+                    consentAppearance: "compact" as const,
+                    mobileConsent: "inherit" as const,
+                    consentPolicyLink: {
+                      label: tConsent("policyLinkLabel"),
+                      href: "/privacy",
+                    },
+                  })}
               dismissible={false}
               dismissLabel={tConsent("dismissLabel")}
               acceptLabel={tConsent("acceptLabel")}

package/templates/apps/web/app/[locale]/meet/confirmed/BookingHandOff.tsx

@@ -0,0 +1,128 @@
+// oss: false
+"use client"; // Reads sessionStorage (a browser API) once on mount — a server page cannot.
+
+/**
+ * BookingHandOff — `/meet/confirmed`'s booked time and Slack next step
+ * (#9853 D10). The booker writes one `sessionStorage` item before it
+ * navigates here (`BOOKING_CONFIRMATION_STORAGE_KEY`); this reads it once and
+ * removes it, the `/thanks` page's `AccountInviteLink` pattern, so the page's
+ * address carries nothing about the booking and a later visit shows nothing.
+ *
+ * It renders only an item written for this page (`to`'s path, without its
+ * query or hash, is `/meet/confirmed` or `/<locale>/meet/confirmed`) in the last ten
+ * minutes. The time is formatted in the zone Cal.com recorded, with the zone
+ * named, so the page and the Slack welcome name the same one; a zone `Intl`
+ * does not know renders nothing. Every string is a prop the server page read
+ * from the `schedule` namespace.
+ */
+import { Container, Heading, Text } from "@working-theory/ui";
+import {
+  BOOKING_CONFIRMATION_STORAGE_KEY,
+  BookingConfirmationHandOffSchema,
+} from "@working-theory/validation";
+import type { ReactElement } from "react";
+import { useEffect, useState } from "react";
+
+/** A reserved name that never resolves: only used to read the path of `to`. */
+const PLACEHOLDER_ORIGIN = "https://placeholder.invalid";
+const CONFIRMED_PATH = "/meet/confirmed";
+const MAX_AGE_MS = 10 * 60_000;
+
+interface Props {
+  locale: string;
+  /** `schedule.confirmed.bookedTimeHeading`. */
+  bookedTimeHeading: string;
+  /** `schedule.confirmed.slackHeadline`. */
+  slackHeadline: string;
+  /** `schedule.confirmed.slackBody`. */
+  slackBody: string;
+}
+
+interface Shown {
+  time: string;
+  slackOptIn: boolean;
+}
+
+/** Whether `to` names this page, with or without this page's `/<locale>`. */
+function namesThisPage(to: string, locale: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(to, PLACEHOLDER_ORIGIN);
+  } catch {
+    return false;
+  }
+  if (url.origin !== PLACEHOLDER_ORIGIN) return false;
+  return (
+    url.pathname === CONFIRMED_PATH ||
+    url.pathname === `/${locale}${CONFIRMED_PATH}`
+  );
+}
+
+/** Read the hand-off once, remove it, and answer what to show (or `null`). */
+function takeHandOff(locale: string): Shown | null {
+  try {
+    const stored = window.sessionStorage.getItem(
+      BOOKING_CONFIRMATION_STORAGE_KEY,
+    );
+    if (stored === null) return null;
+    window.sessionStorage.removeItem(BOOKING_CONFIRMATION_STORAGE_KEY);
+    const parsed = BookingConfirmationHandOffSchema.safeParse(
+      JSON.parse(stored),
+    );
+    if (!parsed.success) return null;
+    const { to, savedAt, start, timeZone, slackOptIn } = parsed.data;
+    const age = Date.now() - savedAt;
+    if (!namesThisPage(to, locale) || age < 0 || age >= MAX_AGE_MS) return null;
+    const time = new Intl.DateTimeFormat(locale, {
+      weekday: "long",
+      month: "long",
+      day: "numeric",
+      hour: "numeric",
+      minute: "2-digit",
+      timeZone,
+      timeZoneName: "longGeneric",
+    }).format(new Date(start));
+    return { time, slackOptIn };
+  } catch {
+    // Unparseable JSON, refused storage, or a zone `Intl` does not know.
+    return null;
+  }
+}
+
+export function BookingHandOff({
+  locale,
+  bookedTimeHeading,
+  slackHeadline,
+  slackBody,
+}: Props): ReactElement | null {
+  const [shown, setShown] = useState<Shown | null>(null);
+
+  useEffect(() => {
+    // Only ever sets: React's development double-mount runs this twice, and
+    // the second run finds the item already removed.
+    const found = takeHandOff(locale);
+    if (found !== null) setShown(found);
+  }, [locale]);
+
+  if (shown === null) return null;
+  return (
+    <Container className="pt-block-loose">
+      <div role="status" data-testid="booking-hand-off">
+        <Heading level={2} visual={4}>
+          {bookedTimeHeading}
+        </Heading>
+        <Text className="mt-2">{shown.time}</Text>
+        {shown.slackOptIn && (
+          <>
+            <Heading level={2} visual={4} className="mt-block-tight">
+              {slackHeadline}
+            </Heading>
+            <Text tone="muted" className="mt-2">
+              {slackBody}
+            </Text>
+          </>
+        )}
+      </div>
+    </Container>
+  );
+}

package/templates/apps/web/app/[locale]/meet/confirmed/__tests__/BookingHandOff.test.tsx

@@ -0,0 +1,126 @@
+// oss: false
+/**
+ * Tests for `/meet/confirmed`'s booking hand-off (#9853 D9, D10; AC-7).
+ *
+ * The booker hands this page the booked time, its zone and the Slack opt-in
+ * through one `sessionStorage` item, never the address. The component reads
+ * it once and removes it, and shows it only when it was written for this page
+ * in the last ten minutes, formatted in the zone Cal.com recorded — the
+ * prospect's, not the viewer's. Anything else renders nothing.
+ */
+import React from "react";
+import { act, render, screen } from "@testing-library/react";
+
+import { BookingHandOff } from "../BookingHandOff";
+
+const STORAGE_KEY = "ailk:booking-confirmation";
+const PROPS = {
+  locale: "en",
+  bookedTimeHeading: "copy:confirmed.bookedTimeHeading",
+  slackHeadline: "copy:confirmed.slackHeadline",
+  slackBody: "copy:confirmed.slackBody",
+};
+
+function handOff(overrides: Record<string, unknown> = {}) {
+  return {
+    to: "/meet/confirmed",
+    savedAt: Date.now(),
+    start: "2026-10-30T20:00:00.000Z",
+    timeZone: "America/Denver",
+    slackOptIn: true,
+    ...overrides,
+  };
+}
+
+function store(value: unknown): void {
+  window.sessionStorage.setItem(
+    STORAGE_KEY,
+    typeof value === "string" ? value : JSON.stringify(value),
+  );
+}
+
+async function renderHandOff() {
+  let utils!: ReturnType<typeof render>;
+  await act(async () => {
+    utils = render(<BookingHandOff {...PROPS} />);
+  });
+  return utils;
+}
+
+beforeEach(() => {
+  window.sessionStorage.clear();
+  window.history.replaceState(null, "", "/en/meet/confirmed");
+});
+
+describe("<BookingHandOff/> (#9853 AC-7)", () => {
+  it("shows the booked time in the prospect's zone, named, and the Slack step; then forgets it", async () => {
+    store(handOff());
+    const { container } = await renderHandOff();
+
+    expect(screen.getByText(PROPS.bookedTimeHeading)).toBeInTheDocument();
+    expect(container.textContent).toContain("2:00");
+    expect(container.textContent).toContain("Mountain Time");
+    expect(screen.getByText(PROPS.slackHeadline)).toBeInTheDocument();
+    expect(screen.getByText(PROPS.slackBody)).toBeInTheDocument();
+    expect(screen.getByRole("status")).toBeInTheDocument();
+    expect(window.sessionStorage.getItem(STORAGE_KEY)).toBeNull();
+  });
+
+  it("accepts a destination written with a locale prefix, a query or a hash", async () => {
+    store(handOff({ to: "/en/meet/confirmed?x=1#top" }));
+    const { container } = await renderHandOff();
+    expect(container.textContent).toContain("Mountain Time");
+  });
+
+  it("shows no Slack text when the box was not ticked", async () => {
+    store(handOff({ slackOptIn: false }));
+    const { container } = await renderHandOff();
+    expect(container.textContent).toContain("Mountain Time");
+    expect(screen.queryByText(PROPS.slackHeadline)).toBeNull();
+    expect(screen.queryByText(PROPS.slackBody)).toBeNull();
+  });
+
+  it.each<[string, () => void]>([
+    ["no item", () => undefined],
+    ["an unparseable item", () => store("{not json")],
+    [
+      "an item with an extra email key",
+      () => store(handOff({ email: "ada@example.com" })),
+    ],
+    [
+      "an item for another page",
+      () => store(handOff({ to: "/before-your-call" })),
+    ],
+    [
+      "an item eleven minutes old",
+      () => store(handOff({ savedAt: Date.now() - 11 * 60_000 })),
+    ],
+    [
+      "a zone Intl does not know",
+      () => store(handOff({ timeZone: "Mars/Olympus" })),
+    ],
+  ])("renders nothing, and removes the item, for %s", async (_label, seed) => {
+    seed();
+    const { container } = await renderHandOff();
+    expect(container).toBeEmptyDOMElement();
+    expect(window.sessionStorage.getItem(STORAGE_KEY)).toBeNull();
+  });
+
+  it("shows nothing on a later visit", async () => {
+    store(handOff());
+    const first = await renderHandOff();
+    first.unmount();
+    const { container } = await renderHandOff();
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it.each([
+    "/fr/meet/confirmed",
+    "/anything/meet/confirmed",
+    "//evil.example/meet/confirmed",
+  ])("renders nothing for a destination of %s", async (to) => {
+    store(handOff({ to }));
+    const { container } = await renderHandOff();
+    expect(container).toBeEmptyDOMElement();
+  });
+});

package/templates/apps/web/app/[locale]/pricing/__tests__/unconnected.test.tsx

@@ -23,6 +23,7 @@ import {
 import type { PageSection } from "@working-theory/validation";
 import type { ReactElement } from "react";
 
+import { TOPOLOGY } from "../../../../lib/topology.generated";
 import * as pricingPage from "../page";
 import PricingPage, { generateMetadata } from "../page";
 
@@ -219,6 +220,48 @@ describe("/pricing on an unconnected site is today's page (#8927 AC-4)", () => {
     expect(served).toBe(await oracleHtml(undefined, true));
   });
 
+  // #9480 — the browser-facing origin is read through the topology seam
+  // (#7874 D12). The committed seam is the hub render, so this case runs it
+  // unmocked. #8060 — hub-only: a spoke render of the seam reads no
+  // NEXT_PUBLIC_AILK_API_URL, so a spoke scaffold skips this case.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "on a hub, reads the shown set in production configured only by the browser-facing origin",
+    async () => {
+      for (const name of API_ENV) delete process.env[name];
+      process.env.NEXT_PUBLIC_AILK_API_URL = "https://api.example.test";
+      (process.env as Record<string, string>).NODE_ENV = "production";
+
+      const served = await pageHtml({}, true);
+
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+      expect(String(fetchMock.mock.calls[0][0])).toMatch(
+        /^https:\/\/api\.example\.test\/v1\/content\/shown-offerings/,
+      );
+      expect(served).toBe(await oracleHtml(undefined, true));
+    },
+  );
+
+  it("on a spoke (the seam's spoke render), that origin is not read in production", async () => {
+    for (const name of API_ENV) delete process.env[name];
+    process.env.NEXT_PUBLIC_AILK_API_URL = "https://api.example.test";
+    (process.env as Record<string, string>).NODE_ENV = "production";
+
+    await jest.isolateModulesAsync(async () => {
+      jest.doMock("../../../../lib/api-origin.generated", () => ({
+        browserApiOrigin: (): string | undefined => undefined,
+      }));
+      const spoke = await import("../page");
+      await spoke.default({
+        params: Promise.resolve({ locale: "en" }),
+        searchParams: Promise.resolve({}),
+        getMdxSource,
+        getPageSections,
+      });
+    });
+
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
   it("keeps the MDX page's metadata and renders per request", async () => {
     const params = Promise.resolve({ locale: "en" });
 

package/templates/apps/web/app/[locale]/pricing/page.tsx

@@ -36,6 +36,7 @@ import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
+import { browserApiOrigin } from "../../../lib/api-origin.generated";
 import {
   offeringsPricing,
   type OfferingsPricing,
@@ -114,13 +115,16 @@ function sharedRead(
 
 /**
  * Whether an API origin is configured: the three names `getApiBase()` in
- * packages/api-client/src/http.ts reads, in step with it. Without one that
- * function answers `localhost:3001`.
+ * packages/api-client/src/http.ts reads, in step with it on a hub. Without one
+ * that function answers `localhost:3001`. The browser-facing origin comes from
+ * the topology seam (#7874 D12), which a spoke renders with no env read, so a
+ * spoke passes its own `env:check` (#9480). A spoke diverges on purpose: the
+ * browser-facing name set on one at runtime counts as no origin here.
  */
 function apiOriginConfigured(): boolean {
   return Boolean(
     process.env.AILK_API_URL ||
-    process.env.NEXT_PUBLIC_AILK_API_URL ||
+    browserApiOrigin() ||
     process.env.NEXT_PUBLIC_API_URL,
   );
 }

package/templates/apps/web/app/api/offerings/checkout/[lookupKey]/__tests__/route.test.ts

@@ -0,0 +1,222 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * The Offerings buy route's API origin on each topology (#9419). The route
+ * takes its browser-facing origin from the #7874 D12 seam
+ * (`lib/api-origin.generated.ts`), never from `NEXT_PUBLIC_AILK_API_URL`
+ * itself: a spoke's render of that seam reads no env, so a fresh
+ * `--topology spoke` scaffold passes its own `env:check` (SPOKE_REFUSED_ENV,
+ * #7874 D5). The rest of the ladder is pinned in `../../__tests__/route.test.ts`.
+ *
+ * Each case loads the route in its own module registry, so no case reads
+ * another's shared shown-set answer; a spoke case swaps in the spoke render
+ * of both generated seams, as `lib/__tests__/relay.test.ts` does.
+ */
+import { workspaceShownSetSchema } from "@working-theory/validation";
+
+import { TOPOLOGY } from "../../../../../../lib/topology.generated";
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn(async () => ({ features: ["commerce"] })),
+}));
+
+const ORIGIN_SEAM = "../../../../../../lib/api-origin.generated";
+const TOPOLOGY_SEAM = "../../../../../../lib/topology.generated";
+const HUB_API = "https://api.example.test";
+
+/** One shown plan with one price, `growth_monthly`, in the wire shape. */
+const SHOWN_SET = workspaceShownSetSchema
+  .partial({ workspaceId: true, organizationId: true })
+  .parse({
+    productIds: ["prod_growth"],
+    recommended: { plan: null, addon: null },
+    offerings: [
+      {
+        productId: "prod_growth",
+        plan: "growth",
+        name: "growth",
+        description: null,
+        marketingFeatures: [],
+        unitLabel: null,
+        note: null,
+        termsNote: null,
+        ailkGroup: "plan",
+        ailkOrder: null,
+        prices: [
+          {
+            priceId: "price_growthmonthly",
+            lookupKey: "growth_monthly",
+            plan: "growth",
+            period: "monthly",
+            interval: "month",
+            amount: 4900,
+            currency: "usd",
+          },
+        ],
+        recommended: false,
+      },
+    ],
+    state: "current",
+    snapshotAt: "2026-10-21T00:00:00.000Z",
+  });
+
+const env = process.env as Record<string, string | undefined>;
+const ENV_NAMES = [
+  "AILK_API_URL",
+  "NEXT_PUBLIC_AILK_API_URL",
+  "NEXT_PUBLIC_API_URL",
+  "NEXT_PUBLIC_BASE_URL",
+  "NODE_ENV",
+  "OSS_API_INTERNAL_SECRET",
+  "AILK_SPOKE_KEY",
+] as const;
+const savedEnv = Object.fromEntries(ENV_NAMES.map((name) => [name, env[name]]));
+
+function json(status: number, body: unknown): Promise<Response> {
+  return Promise.resolve(
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+}
+
+/** The shown-set read answers `shownStatus`; the session POST starts one. */
+let shownStatus: "unconnected" | "shown";
+const realFetch = global.fetch;
+const fetchMock = jest.fn(
+  (input: string | URL | Request, _init?: RequestInit) => {
+    if (new URL(String(input)).pathname === "/v1/checkout/sessions") {
+      return json(201, {
+        sessionId: "cs_test_a1",
+        url: "https://checkout.stripe.com/c/pay/cs_test_a1",
+      });
+    }
+    return json(200, {
+      ok: true,
+      data: { status: shownStatus, shownSet: SHOWN_SET },
+    });
+  },
+);
+let warnSpy: jest.SpyInstance;
+
+beforeAll(() => {
+  global.fetch = fetchMock as jest.Mock;
+});
+
+afterAll(() => {
+  global.fetch = realFetch;
+  for (const name of ENV_NAMES) {
+    if (savedEnv[name] === undefined) delete env[name];
+    else env[name] = savedEnv[name];
+  }
+});
+
+beforeEach(() => {
+  for (const name of ENV_NAMES) delete env[name];
+  env.NODE_ENV = "production";
+  env.NEXT_PUBLIC_BASE_URL = "https://shop.example.com";
+  shownStatus = "unconnected";
+  fetchMock.mockClear();
+  warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
+});
+
+afterEach(() => {
+  warnSpy.mockRestore();
+});
+
+/** A buyer's click on `growth_monthly`, served by a site of `topology`. */
+async function buy(topology: "hub" | "spoke"): Promise<Response> {
+  let res: Response | undefined;
+  await jest.isolateModulesAsync(async () => {
+    // A doMock outlives the registry it was made in, so a hub case undoes it.
+    if (topology === "spoke") {
+      jest.doMock(ORIGIN_SEAM, () => ({
+        browserApiOrigin: (): string | undefined => undefined,
+      }));
+      jest.doMock(TOPOLOGY_SEAM, () => ({
+        ...jest.requireActual(TOPOLOGY_SEAM),
+        TOPOLOGY: "spoke",
+      }));
+    } else {
+      jest.dontMock(ORIGIN_SEAM);
+      jest.dontMock(TOPOLOGY_SEAM);
+    }
+    const { GET } = await import("../route");
+    const request = new Request(
+      "https://shop.example.com/api/offerings/checkout/growth_monthly",
+      {
+        headers: {
+          "sec-fetch-mode": "navigate",
+          "sec-fetch-dest": "document",
+          "sec-fetch-site": "same-origin",
+        },
+      },
+    );
+    res = await GET(request, {
+      params: Promise.resolve({ lookupKey: "growth_monthly" }),
+    });
+  });
+  if (res === undefined) throw new Error("the route did not answer");
+  return res;
+}
+
+function postHeaders(): Record<string, string> {
+  const post = fetchMock.mock.calls.find(
+    ([input]) => new URL(String(input)).pathname === "/v1/checkout/sessions",
+  );
+  if (post === undefined) throw new Error("no session POST");
+  return (post[1]?.headers ?? {}) as Record<string, string>;
+}
+
+describe("the route's API origin comes from the topology seam", () => {
+  it("on a spoke, a set NEXT_PUBLIC_AILK_API_URL is not an API origin", async () => {
+    env.NEXT_PUBLIC_AILK_API_URL = HUB_API;
+
+    const res = await buy("spoke");
+
+    expect(res.status).toBe(303);
+    expect(res.headers.get("location")).toBe("/pricing");
+    expect(warnSpy).toHaveBeenCalledWith(
+      "[offerings-checkout] refused reason=unconnected",
+    );
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("on a spoke, the server-only AILK_API_URL is the API origin", async () => {
+    env.AILK_API_URL = HUB_API;
+
+    await buy("spoke");
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  // The committed seam is the hub render, so this case runs it unmocked.
+  // #8060 — hub-only: a spoke render of the seam reads no
+  // NEXT_PUBLIC_AILK_API_URL, so a spoke scaffold skips this case.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "on a hub, NEXT_PUBLIC_AILK_API_URL is the API origin through the seam",
+    async () => {
+      env.NEXT_PUBLIC_AILK_API_URL = HUB_API;
+
+      await buy("hub");
+
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  it("a spoke with no spoke key never sends the internal secret", async () => {
+    // The transport check skips NEXT_PUBLIC_AILK_API_URL on a spoke, while
+    // the api-client still sends there: only the topology withholds it.
+    env.NODE_ENV = "test";
+    env.NEXT_PUBLIC_AILK_API_URL = "http://api.remote.example";
+    env.OSS_API_INTERNAL_SECRET = "s3cret";
+    shownStatus = "shown";
+
+    await buy("spoke");
+
+    expect(postHeaders()["x-internal-auth"]).toBeUndefined();
+  });
+});

package/templates/apps/web/app/api/offerings/checkout/[lookupKey]/route.ts

@@ -14,8 +14,10 @@
 import { checkout, offerings } from "@working-theory/api-client";
 import { parseLookupKey } from "@working-theory/validation";
 
+import { browserApiOrigin } from "../../../../../lib/api-origin.generated";
 import { isShownLookupKey } from "../../../../../lib/offerings-pricing";
 import { FALLBACK_BASE_URL } from "../../../../../lib/site-brand";
+import { TOPOLOGY } from "../../../../../lib/topology.generated";
 import { resolveCommerceClaim } from "../../../../../src/lib/commerce-claim";
 import { resolveBaseUrl } from "../../../../../src/lib/routes";
 
@@ -70,12 +72,14 @@ function isBuyerNavigation(request: Request): boolean {
 
 /**
  * The API origin, in the order `getApiBase()` in
- * packages/api-client/src/http.ts reads it.
+ * packages/api-client/src/http.ts reads it. The browser-facing origin comes
+ * from the topology seam (#7874 D12), which a spoke renders with no env read,
+ * so a spoke passes its own `env:check` (#9419).
  */
 function configuredApiBase(): string | undefined {
   return (
     process.env.AILK_API_URL ||
-    process.env.NEXT_PUBLIC_AILK_API_URL ||
+    browserApiOrigin() ||
     process.env.NEXT_PUBLIC_API_URL ||
     undefined
   );
@@ -203,6 +207,8 @@ const START_TIMEOUT_MS = 10_000;
  * D5 — the visitor's forwarded address, so the API's per-IP bucket counts
  * buyers, and the internal secret only from a site that is not a spoke and
  * only to an `https:` or loopback API. Nothing else of the request is sent.
+ * A spoke topology withholds it even with no spoke key: its transport check
+ * skips `NEXT_PUBLIC_AILK_API_URL`, which the api-client still sends to.
  */
 function startHeaders(incoming: Headers): Record<string, string> {
   const headers: Record<string, string> = {};
@@ -210,7 +216,8 @@ function startHeaders(incoming: Headers): Record<string, string> {
   if (visitor) headers["x-forwarded-for"] = visitor;
 
   const secret = process.env.OSS_API_INTERNAL_SECRET;
-  if (secret && !process.env.AILK_SPOKE_KEY?.trim() && isSafeApiTransport()) {
+  const spoke = TOPOLOGY === "spoke" || !!process.env.AILK_SPOKE_KEY?.trim();
+  if (secret && !spoke && isSafeApiTransport()) {
     headers["x-internal-auth"] = secret;
   }
   return headers;