create-ailk 0.24.0 → 0.26.0

package/templates/apps/web/app/api/revalidate/route.ts

@@ -31,7 +31,7 @@
  *
  * Replay window (D7, reopened and closed by #5902): a captured delivery
  * verifies for 5 minutes and no longer, the Slack receiver's tolerance
- * (apps/api/src/routes/slack/actions.ts). Within the window a replay is a
+ * (packages-paid/api-signal-collectors/src/routes/slack/actions.ts). Within the window a replay is a
  * second revalidateTag on an already-purged tag — a no-op — so the receiver
  * still keeps no seen-set.
  *
@@ -65,7 +65,7 @@ const SIGNATURE_TOLERANCE_SECONDS = 5 * 60;
 const TIMESTAMP_SHAPE = /^[0-9]{1,12}$/;
 
 /**
- * The sender's bounds (apps/api/src/services/revalidation.ts), applied again
+ * The sender's bounds (packages/api/src/services/revalidation.ts), applied again
  * here because this route is unauthenticated until the MAC verifies and the
  * values become cache tags. `workspaceId` is logged, never tagged, so it stays
  * a plain string.
@@ -90,7 +90,7 @@ type RevalidateBody = z.infer<typeof bodySchema>;
 
 /**
  * Line-for-line the repo's one shipped verifier
- * (apps/api/src/routes/slack/actions.ts:50-62), with Slack's `v0:<ts>:<body>`
+ * (packages-paid/api-signal-collectors/src/routes/slack/actions.ts:50-62), with Slack's `v0:<ts>:<body>`
  * base string extended by the event (#5902). The length guard is required,
  * not decorative: timingSafeEqual throws on unequal lengths. The `sha256=`
  * prefix stays inside the compared material so a same-length `sha512=` header

package/templates/apps/web/auth.ts

@@ -459,7 +459,9 @@ export function createAuth(deps: CreateAuthDeps = {}) {
     /**
      * The sign-up grants (#8765 D4): the user hook decides whether the new
      * user carries agreements, the account hook writes them on the captured
-     * transaction client. No other database hook is installed.
+     * transaction client. A magic-link sign-up creates no Account, so the
+     * session hook writes its grants, in their own transaction, before the
+     * session exists (#9667 D5). No other database hook is installed.
      */
     databaseHooks: signUpAgreementHooks(),
     secret: resolveSecret(),
@@ -560,7 +562,7 @@ export function createAuth(deps: CreateAuthDeps = {}) {
      *
      * So: when the IP is resolvable the § D8a values apply as specified; when
      * it is not, we fall through to the library's shorter-recovery defaults.
-     * This is the same reasoning `apps/api/src/lib/auth-email-budget.ts`
+     * This is the same reasoning `packages/api/src/lib/auth-email-budget.ts`
      * applies to the site-wide send cap it declines to implement — a
      * site-wide cap an attacker can hold open is a denial of the control it
      * implements — and the two now agree instead of contradicting each other.
@@ -568,7 +570,7 @@ export function createAuth(deps: CreateAuthDeps = {}) {
      * STORAGE CAVEAT, load-bearing and NOT solved here: `"memory"` is a
      * process-local Map, so on a multi-instance deployment the effective
      * ceiling is 5 × N per 900 s — the identical caveat
-     * `apps/api/src/middleware/rate-limit.ts` documents for itself. The
+     * `packages/api/src/middleware/rate-limit.ts` documents for itself. The
      * durable alternative needs a rate-limit table the schema does not have,
      * and this issue adds no migration. What does bound the consequence is
      * the per-recipient send budget at the apps/api relay.
@@ -671,9 +673,11 @@ export function createAuth(deps: CreateAuthDeps = {}) {
     /**
      * `magicLink` only when its predicate holds (#7435 § D2): absent, its
      * `/sign-in/magic-link` and `/magic-link/verify` endpoints do not exist.
-     * Sign-in only — the callback mails existing users and nobody else, and
-     * `disableSignUp` refuses to create one even for a live token
-     * (lib/auth-email.ts).
+     * Sign-in only while sign-up is closed — the callback mails existing users
+     * and nobody else, and `disableSignUp` refuses to create one even for a
+     * live token (lib/auth-email.ts). While `isSignUpOpen()` a request
+     * carrying the agreements is a sign-up: its token is bound to them, and
+     * the verify creates the account only for a token so bound (#9667).
      *
      * `signUpAgreementsPlugin` always (#8765 D3): while sign-up is open,
      * `/sign-up/email` without every sign-up agreement is refused before the

package/templates/apps/web/i18n/request.ts

@@ -4,6 +4,14 @@
 // English when no catalog exists (e.g. a locale is enabled in project.yaml
 // but its messages/<locale>.json has not been translated yet).
 //
+// The site's own strings (#9401 D8) live in messages/site/<locale>.json, an
+// overlay the template ships as `{}` and never changes, so `create-ailk
+// update` keeps a site's edit of it. It falls back to the English overlay,
+// then to nothing, and merges add-only: a key the template catalog already
+// has keeps the template's value. The merge builds new objects, descends only
+// into plain objects, takes only string leaves and skips prototype keys, so
+// it can neither mutate the imported catalog nor pollute `Object.prototype`.
+//
 // Spec: docs/internal/specs/i18n-phase1-s2-next-intl-foundation-spec.md
 
 import type { AbstractIntlMessages } from "next-intl";
@@ -11,6 +19,42 @@ import { getRequestConfig } from "next-intl/server";
 
 const DEFAULT_LOCALE = "en";
 
+const UNSAFE_KEYS: ReadonlySet<string> = new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+]);
+
+type Catalog = Record<string, unknown>;
+
+function isCatalog(value: unknown): value is Catalog {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** `base` with every key of `overlay` it lacks added — new objects, never a mutation. */
+function mergeAddOnly(base: Catalog, overlay: Catalog): Catalog {
+  const out: Catalog = { ...base };
+  for (const [key, value] of Object.entries(overlay)) {
+    if (UNSAFE_KEYS.has(key)) continue;
+    const has = Object.prototype.hasOwnProperty.call(base, key);
+    if (typeof value === "string") {
+      if (!has) out[key] = value;
+    } else if (isCatalog(value)) {
+      if (!has) out[key] = mergeAddOnly({}, value);
+      else if (isCatalog(base[key])) out[key] = mergeAddOnly(base[key], value);
+    }
+  }
+  return out;
+}
+
+async function loadSiteOverlay(locale: string): Promise<Catalog> {
+  const mod =
+    (await import(`../messages/site/${locale}.json`).catch(() => null)) ??
+    (await import(`../messages/site/${DEFAULT_LOCALE}.json`).catch(() => null));
+  const overlay: unknown = mod ? (mod.default ?? mod) : null;
+  return isCatalog(overlay) ? overlay : {};
+}
+
 export default getRequestConfig(async ({ requestLocale }) => {
   // requestLocale is the modern API (next-intl >= 3.22). It resolves the
   // active locale from the request, validated by middleware.
@@ -32,5 +76,9 @@ export default getRequestConfig(async ({ requestLocale }) => {
     messages = (fallback.default ?? fallback) as AbstractIntlMessages;
   }
 
-  return { locale, messages };
+  const overlay = await loadSiteOverlay(locale);
+  return {
+    locale,
+    messages: mergeAddOnly(messages, overlay) as AbstractIntlMessages,
+  };
 });

package/templates/apps/web/jest.config.cjs

@@ -3,6 +3,7 @@
 module.exports = {
   preset: "ts-jest",
   globalSetup: require.resolve("../../tools/jest/pin-timezone.cjs"),
+  reporters: require("../../tools/jest/reporters.cjs"),
   testEnvironment: "jsdom",
   roots: [
     "<rootDir>/__tests__",

package/templates/apps/web/lib/__tests__/account-config.test.ts

@@ -26,6 +26,8 @@
  *      401/403) is `false`, any other failure rejects. The popups are bound
  *      in the route (`account/new-popups.tsx`, tested beside it): this file
  *      imports nothing under `(authed)`.
+ *   8. #9401 AC-11 — the template's `site-contributions.ts` stub ships no
+ *      Billing section either; a site fills it.
  */
 
 const mockSignupMe = jest.fn();
@@ -68,6 +70,7 @@ import {
   accountSettingsSections,
   type AccountNewRead,
 } from "../account-config";
+import { siteBillingSections } from "../site-contributions";
 
 const INIT = { headers: { cookie: "session=abc" } };
 
@@ -166,6 +169,10 @@ describe("account-config exports (AC-6)", () => {
     expect(accountBillingSections).toEqual([]);
   });
 
+  it("ships no site Billing section either: the stub is the site's to fill (#9401 AC-11, D7)", () => {
+    expect(siteBillingSections).toEqual([]);
+  });
+
   it("ships the base kinds and the member kinds in their sections (#8231 D4–D6)", () => {
     expect(accountInboxKinds.map((k) => [k.kind, k.section])).toEqual([
       ["result", "updates"],

package/templates/apps/web/lib/__tests__/auth-email.test.ts

@@ -451,3 +451,279 @@ describe("sendMagicLink — existing users only, deferred (#7435 § D3, AC-2)",
     });
   });
 });
+
+// ── #9667 — a magic link can create the account (D1, D4) ───────────────────
+
+describe("sendMagicLink — the sign-up branch on an open site (#9667 D1, D4)", () => {
+  const AGREED = { agreements: ["account_terms"], locale: "en" };
+
+  it("disableSignUp follows AILK_AUTH_SIGNUP_OPEN", () => {
+    delete process.env.AILK_AUTH_SIGNUP_OPEN;
+    expect(makeMagicLinkOptions({ send: jest.fn() }).disableSignUp).toBe(true);
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    expect(makeMagicLinkOptions({ send: jest.fn() }).disableSignUp).toBe(false);
+  });
+
+  it("binds, then mails ONE sign-up email to an unknown address with userId \"sign-up\" (#9720 AC-1)", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn().mockResolvedValue({ ok: true });
+    const bind = jest.fn().mockResolvedValue(AGREED);
+    const { lines, log } = makeLog();
+    const { ctx, background } = makeCtx(null);
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink(
+      { email: "new@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      ctx,
+    );
+    await Promise.all(background);
+
+    expect(bind).toHaveBeenCalledWith(
+      ctx.context.internalAdapter,
+      "MLTOKEN",
+      AGREED,
+      MAGIC_LINK_TTL_SECONDS,
+    );
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(JSON.parse(send.mock.calls[0]![0] as string)).toEqual({
+      kind: "magic-link-sign-up",
+      userId: "sign-up",
+      to: "new@example.com",
+      url: LINK,
+      agreements: ["account_terms"],
+      locale: "en",
+    });
+    const serialized = JSON.stringify(lines);
+    expect(serialized).not.toContain("new@example.com");
+    expect(serialized).not.toContain("MLTOKEN");
+  });
+
+  it("binds, then mails the account, for a known address", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn().mockResolvedValue({ ok: true });
+    const bind = jest.fn().mockResolvedValue(AGREED);
+    const { log } = makeLog();
+    const { ctx, background } = makeCtx({ id: "user_1", email: "person@example.com" });
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink(
+      { email: "Person@Example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      ctx,
+    );
+    await Promise.all(background);
+
+    expect(bind).toHaveBeenCalledTimes(1);
+    expect(JSON.parse(send.mock.calls[0]![0] as string)).toMatchObject({
+      userId: "user_1",
+      to: "person@example.com",
+    });
+  });
+
+  it("a failed binding sends nothing to an unknown address and logs bind_failed", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn();
+    const bind = jest.fn().mockRejectedValue(new Error("db down for new@example.com"));
+    const { lines, log } = makeLog();
+    const { ctx, runInBackgroundOrAwait } = makeCtx(null);
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await expect(
+      sendMagicLink(
+        { email: "new@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+        ctx,
+      ),
+    ).resolves.toBeUndefined();
+
+    expect(runInBackgroundOrAwait).not.toHaveBeenCalled();
+    expect(send).not.toHaveBeenCalled();
+    expect(lines[0]).toEqual({
+      level: "warn",
+      fields: { kind: "magic-link", reason: "send_failed", errorKind: "bind_failed" },
+    });
+    const serialized = JSON.stringify(lines);
+    expect(serialized).not.toContain("new@example.com");
+    expect(serialized).not.toContain("MLTOKEN");
+  });
+
+  it("a sign-in request (no metadata) on an open site still sends nothing to an unknown address", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn();
+    const bind = jest.fn();
+    const { lines, log } = makeLog();
+    const { ctx, runInBackgroundOrAwait } = makeCtx(null);
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink({ email: "nobody@example.com", url: LINK, token: "MLTOKEN" }, ctx);
+
+    expect(bind).not.toHaveBeenCalled();
+    expect(runInBackgroundOrAwait).not.toHaveBeenCalled();
+    expect(send).not.toHaveBeenCalled();
+    expect(lines).toEqual([
+      { level: "info", fields: { kind: "magic-link", reason: "no_account" } },
+    ]);
+  });
+});
+
+// ── #9720 — the sign-up email names the agreements (D6) ────────────────────
+
+describe("sendMagicLink — the sign-up kind (#9720 D6)", () => {
+  const AGREED = { agreements: ["account_terms"], locale: "en" };
+
+  it("takes the agreements and locale from the binding, not the request", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn().mockResolvedValue({ ok: true });
+    const bind = jest
+      .fn()
+      .mockResolvedValue({ agreements: ["account_terms"], locale: "fr" });
+    const { log } = makeLog();
+    const { ctx, background } = makeCtx(null);
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink(
+      { email: "new@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      ctx,
+    );
+    await Promise.all(background);
+
+    expect(JSON.parse(send.mock.calls[0]![0] as string)).toEqual({
+      kind: "magic-link-sign-up",
+      userId: "sign-up",
+      to: "new@example.com",
+      url: LINK,
+      agreements: ["account_terms"],
+      locale: "fr",
+    });
+  });
+
+  it("a known address on a sign-up request gets exactly the sign-in body (AC-2)", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn().mockResolvedValue({ ok: true });
+    const bind = jest.fn().mockResolvedValue(AGREED);
+    const { log } = makeLog();
+    const { ctx, background } = makeCtx({ id: "user_1", email: "person@example.com" });
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink(
+      { email: "Person@Example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      ctx,
+    );
+    await Promise.all(background);
+
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(JSON.parse(send.mock.calls[0]![0] as string)).toEqual({
+      kind: "magic-link",
+      userId: "user_1",
+      to: "person@example.com",
+      url: LINK,
+    });
+  });
+
+  it("on a closed site binds nothing: a known address gets the sign-in body, an unknown one nothing (AC-2)", async () => {
+    delete process.env.AILK_AUTH_SIGNUP_OPEN;
+    const bind = jest.fn().mockResolvedValue(AGREED);
+
+    const knownSend = jest.fn().mockResolvedValue({ ok: true });
+    const known = makeCtx({ id: "user_1", email: "person@example.com" });
+    await makeMagicLinkOptions({ send: knownSend, log: makeLog().log, bind }).sendMagicLink(
+      { email: "person@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      known.ctx,
+    );
+    await Promise.all(known.background);
+
+    const unknownSend = jest.fn();
+    const unknown = makeCtx(null);
+    await makeMagicLinkOptions({ send: unknownSend, log: makeLog().log, bind }).sendMagicLink(
+      { email: "new@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      unknown.ctx,
+    );
+
+    expect(bind).not.toHaveBeenCalled();
+    expect(JSON.parse(knownSend.mock.calls[0]![0] as string)).toEqual({
+      kind: "magic-link",
+      userId: "user_1",
+      to: "person@example.com",
+      url: LINK,
+    });
+    expect(unknownSend).not.toHaveBeenCalled();
+    expect(unknown.runInBackgroundOrAwait).not.toHaveBeenCalled();
+  });
+
+  it("a known and an unknown address answer the same, after the same work, while the send never settles (AC-2)", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const never = () => new Promise(() => undefined);
+
+    for (const user of [{ id: "user_1", email: "person@example.com" }, null]) {
+      const send = jest.fn(never);
+      const bind = jest.fn().mockResolvedValue(AGREED);
+      const { ctx, findUserByEmail, runInBackgroundOrAwait } = makeCtx(user);
+      const { sendMagicLink } = makeMagicLinkOptions({ send, log: makeLog().log, bind });
+
+      await expect(
+        sendMagicLink(
+          { email: "someone@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+          ctx,
+        ),
+      ).resolves.toBeUndefined();
+
+      expect(findUserByEmail).toHaveBeenCalledTimes(1);
+      expect(bind).toHaveBeenCalledTimes(1);
+      expect(runInBackgroundOrAwait).toHaveBeenCalledTimes(1);
+    }
+  });
+
+  it("logs the sign-up send with no address, token or agreement (AC-3)", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn().mockResolvedValue({ ok: true });
+    const bind = jest.fn().mockResolvedValue(AGREED);
+    const { lines, log } = makeLog();
+    const { ctx, background } = makeCtx(null);
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink(
+      { email: "new@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      ctx,
+    );
+    await Promise.all(background);
+
+    expect(lines).toEqual([
+      {
+        level: "info",
+        fields: { userId: "sign-up", kind: "magic-link-sign-up", reason: "sent" },
+      },
+    ]);
+    const serialized = JSON.stringify(lines);
+    expect(serialized).not.toContain("new@example.com");
+    expect(serialized).not.toContain("MLTOKEN");
+    expect(serialized).not.toContain("account_terms");
+  });
+
+  it("signs a sign-up body that carries the agreements and locale (AC-3)", () => {
+    const req = buildAuthEmailRequest(
+      {
+        kind: "magic-link-sign-up",
+        userId: "sign-up",
+        to: "new@example.com",
+        url: LINK,
+        agreements: ["account_terms"],
+        locale: "en",
+      },
+      "webhook-secret",
+    );
+
+    const { createHmac } = require("node:crypto") as typeof import("node:crypto");
+    const timestamp = req.headers["x-ailk-auth-email-timestamp"];
+    expect(req.headers["x-ailk-auth-email-signature"]).toBe(
+      `sha256=${createHmac("sha256", "webhook-secret")
+        .update(`${timestamp}.${req.rawBody}`, "utf8")
+        .digest("hex")}`,
+    );
+    expect(JSON.parse(req.rawBody)).toEqual({
+      kind: "magic-link-sign-up",
+      userId: "sign-up",
+      to: "new@example.com",
+      url: LINK,
+      agreements: ["account_terms"],
+      locale: "en",
+    });
+  });
+});

package/templates/apps/web/lib/auth-email.ts

@@ -18,7 +18,7 @@
  *
  * ONE SERIALIZATION. `buildAuthEmailRequest` builds the body string ONCE,
  * signs THAT string, and hands the same string to the transport — the
- * invariant `apps/api/src/services/revalidation.ts` states for itself ("a
+ * invariant `packages/api/src/services/revalidation.ts` states for itself ("a
  * key-order or whitespace drift between signer and sender is impossible by
  * construction"). This is why the call cannot go through the client's
  * `post()`, which stringifies its own payload argument.
@@ -37,12 +37,24 @@ import { createHmac } from "node:crypto";
 
 import { authEmail } from "@working-theory/api-client";
 
-/** The four fixed kinds the relay will send. A caller picks no copy. */
+import { isSignUpOpen } from "./auth-env";
+import {
+  bindLinkAgreements,
+  signUpMetadata,
+  type LinkAgreements,
+  type LinkAgreementsStore,
+} from "./sign-up-agreements";
+
+/**
+ * The five fixed kinds the relay will send. A caller picks no copy: a sign-up
+ * link sends agreement ids and a locale, which the API names itself (#9720).
+ */
 export type AuthEmailKind =
   | "password-reset"
   | "email-verification"
   | "password-changed"
-  | "magic-link";
+  | "magic-link"
+  | "magic-link-sign-up";
 
 export interface AuthEmailPayload {
   kind: AuthEmailKind;
@@ -50,6 +62,8 @@ export interface AuthEmailPayload {
   to: string;
   url?: string;
   expiresInMinutes?: number;
+  agreements?: string[];
+  locale?: string;
 }
 
 export interface AuthEmailRequest {
@@ -116,6 +130,10 @@ export function buildAuthEmailRequest(
     ...(payload.expiresInMinutes !== undefined
       ? { expiresInMinutes: payload.expiresInMinutes }
       : {}),
+    ...(payload.agreements !== undefined
+      ? { agreements: payload.agreements }
+      : {}),
+    ...(payload.locale !== undefined ? { locale: payload.locale } : {}),
   });
   const timestamp = String(Math.floor(Date.now() / 1000));
   const signature = `sha256=${createHmac("sha256", secret)
@@ -365,7 +383,7 @@ export const MAGIC_LINK_TTL_SECONDS = 300;
  */
 export interface MagicLinkEndpointContext {
   context: {
-    internalAdapter: {
+    internalAdapter: LinkAgreementsStore & {
       findUserByEmail(
         email: string,
       ): Promise<{ user: { id: string; email: string } } | null>;
@@ -390,14 +408,32 @@ export interface MagicLinkEndpointContext {
  * branches cost one indexed read; the send goes to `runInBackgroundOrAwait`,
  * which `auth.ts`'s `backgroundTasks.handler` runs after the response.
  *
+ * A SIGN-UP REQUEST (#9667 D4) — one whose `metadata` carries the agreements,
+ * which `lib/sign-up-agreements.ts`'s plugin has already checked — binds them
+ * to the token, then mails the address whether or not it has an account: a
+ * sign-in link to an existing account, a sign-up link to a new address (whose
+ * `userId` is the fixed sentinel `"sign-up"`; the relay only logs it). The
+ * sign-up link is its own kind, `magic-link-sign-up`, carrying the agreement
+ * ids and locale the binding holds, so the email says an account will be
+ * created and names what it records (#9720 D6). The kind is picked from two
+ * values already in hand, inside the same deferred send, so the answer and
+ * its timing do not depend on it. A failed binding mails only an existing
+ * account. A sign-in request is unchanged: an unknown address gets nothing.
+ *
  * NOTHING HERE THROWS, so a known and an unknown address both reach the
  * plugin's `{ status: true }`.
  */
-function makeSendMagicLink(deps: DispatchDeps) {
+function makeSendMagicLink(deps: MagicLinkDeps) {
   const { send } = deps;
   const log = deps.log ?? defaultLog;
+  const bind = deps.bind ?? bindLinkAgreements;
   return async function sendMagicLink(
-    data: { email: string; url: string; token: string },
+    data: {
+      email: string;
+      url: string;
+      token: string;
+      metadata?: Record<string, unknown>;
+    },
     ctx?: MagicLinkEndpointContext,
   ): Promise<void> {
     let found: { user: { id: string; email: string } } | null;
@@ -413,37 +449,83 @@ function makeSendMagicLink(deps: DispatchDeps) {
       return;
     }
 
-    if (!found) {
+    // A sign-up request (#9667 D2, D4): `metadata` carries the agreements,
+    // which the sign-up-agreements plugin has already checked. The binding
+    // is written whether or not the address has an account, so the work
+    // before the response never depends on it.
+    let binding: LinkAgreements | null = null;
+    const signUp = isSignUpOpen() ? signUpMetadata(data) : null;
+    if (signUp) {
+      try {
+        binding = await bind(
+          ctx.context.internalAdapter,
+          data.token,
+          signUp,
+          MAGIC_LINK_TTL_SECONDS,
+        );
+      } catch {
+        log.warn({
+          kind: "magic-link",
+          reason: "send_failed",
+          errorKind: "bind_failed",
+        });
+      }
+    }
+
+    // A new address has no user yet; the relay only logs `userId`, so a
+    // sign-up link carries the fixed sentinel and the binding's ids, never
+    // the request's (#9720 D6).
+    let payload: AuthEmailPayload;
+    if (found) {
+      payload = {
+        kind: "magic-link",
+        userId: found.user.id,
+        to: found.user.email,
+        url: data.url,
+      };
+    } else if (binding) {
+      payload = {
+        kind: "magic-link-sign-up",
+        userId: "sign-up",
+        to: data.email,
+        url: data.url,
+        agreements: binding.agreements,
+        locale: binding.locale,
+      };
+    } else {
       // No address in the line — the PII boundary holds for unknown addresses
       // too, and they are the ones an enumerator types.
       log.info({ kind: "magic-link", reason: "no_account" });
       return;
     }
 
-    const { user } = found;
     // Not awaited: `runInBackgroundOrAwait` never rejects, and `dispatch`
     // swallows its own failures into a log line.
-    void ctx.context.runInBackgroundOrAwait(
-      dispatch(
-        { kind: "magic-link", userId: user.id, to: user.email, url: data.url },
-        { send, log },
-      ),
-    );
+    void ctx.context.runInBackgroundOrAwait(dispatch(payload, { send, log }));
   };
 }
 
+interface MagicLinkDeps extends DispatchDeps {
+  /** Binds a sign-up request's agreements to its token (#9667 D4). */
+  bind?: typeof bindLinkAgreements;
+}
+
 /**
  * The options `auth.ts` hands Better Auth's `magicLink()` plugin (#7435 § D2).
  *
- * `disableSignUp: true` is defence in depth behind § D3: even a leaked token
- * for an address with no account cannot create one. `storeToken: "hashed"`
- * keeps a database read from yielding a live sign-in token. `allowedAttempts`
- * is left unset — the plugin consumes atomically regardless and warns on any
- * value but 1.
+ * `disableSignUp` follows `isSignUpOpen()`, read when `createAuth()` builds
+ * the plugin — the moment and the predicate `emailAndPassword.disableSignUp`
+ * uses, so the two methods never disagree (#9667 D1). Closed, it is defence
+ * in depth behind § D3: even a leaked token for an address with no account
+ * cannot create one. Open, the verify creates the account only for a token
+ * with an agreements binding (`lib/sign-up-agreements.ts`). `storeToken:
+ * "hashed"` keeps a database read from yielding a live sign-in token.
+ * `allowedAttempts` is left unset — the plugin consumes atomically regardless
+ * and warns on any value but 1.
  */
-export function makeMagicLinkOptions(deps: DispatchDeps) {
+export function makeMagicLinkOptions(deps: MagicLinkDeps) {
   return {
-    disableSignUp: true,
+    disableSignUp: !isSignUpOpen(),
     expiresIn: MAGIC_LINK_TTL_SECONDS,
     storeToken: "hashed" as const,
     sendMagicLink: makeSendMagicLink(deps),