create-ailk 0.29.1 → 0.31.0

package/templates/apps/web/app/[locale]/layout.tsx

@@ -25,10 +25,17 @@
 // every page in the tree (#4090 item 1).
 import "../globals.css";
 
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
 import { Telemetry, VerificationMeta } from "@working-theory/analytics";
+import {
+  SiteConsentSchema,
+  type ConsentAppearance,
+} from "@working-theory/site-config/schema";
 import { MarketingShell } from "@working-theory/templates/shells";
 import { themeToShellCss } from "@working-theory/theme";
-import { Link, isRtl, localeHref } from "@working-theory/ui";
+import { Link, NewsletterSignupProvider, isRtl, localeHref } from "@working-theory/ui";
 import { BRAND_PATHS, LocaleSwitcherNav } from "@working-theory/ui/blocks";
 import {
   Banner,
@@ -54,6 +61,7 @@ import { cookies, headers } from "next/headers";
 import { NextIntlClientProvider } from "next-intl";
 import { getMessages, getTranslations } from "next-intl/server";
 import type { ReactElement, ReactNode } from "react";
+import { parse as parseYaml } from "yaml";
 
 import { GoogleAnalytics } from "../../components/google-analytics";
 import {
@@ -71,6 +79,8 @@ import {
 import {
   inPageView,
   newsletterSignup,
+  type InPageView,
+  type NewsletterFormView,
   readCaptureStatus,
   readServedMagnet,
 } from "../../lib/in-page-magnet";
@@ -84,6 +94,7 @@ import { footerColumns, navItems } from "../../lib/nav-config";
 import { navMessageKeys, usedNavLabelKeys } from "../../lib/nav-label-keys";
 import { getOgImageUrl } from "../../lib/og";
 import {
+  readClosingFooterSettings,
   resolveChromePage,
   resolveHomeChrome,
   resolvePageChrome,
@@ -98,6 +109,7 @@ import {
   COPYRIGHT_HOLDER,
   SITE_DESCRIPTION,
   SITE_NAME,
+  resolveContentRoot,
 } from "../../lib/site-brand";
 import { siteChrome, type SiteChrome } from "../../lib/site-chrome";
 import {
@@ -209,6 +221,38 @@ async function resolveThemeMode(): Promise<ThemeMode> {
 const DECK_FIRST_SLIDE_SELECTOR =
   '.ailk-snap-deck .ailk-section-renderer > :not(.ailk-section-separator):not([data-section="separator"])';
 
+let warnedConsentAppearance = false;
+
+/**
+ * `_site.mdx`'s `consent.appearance` (#10555), else `undefined`. The same
+ * local frontmatter read as `lib/site-header.ts`, validated against the
+ * canonical schema. An absent file, frontmatter or key is silent; an invalid
+ * value warns once per process, naming the field path and never the value.
+ */
+function readConsentAppearance(): ConsentAppearance | undefined {
+  try {
+    const raw = readFileSync(join(resolveContentRoot(), "_site.mdx"), "utf8");
+    const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
+    if (!match) return undefined;
+    const fm: unknown = parseYaml(match[1] ?? "");
+    if (!fm || typeof fm !== "object") return undefined;
+    const { consent } = fm as { consent?: unknown };
+    if (consent === undefined) return undefined;
+    const parsed = SiteConsentSchema.safeParse(consent);
+    if (parsed.success) return parsed.data.appearance;
+    if (!warnedConsentAppearance) {
+      warnedConsentAppearance = true;
+      const issue = parsed.error.issues[0];
+      console.warn(
+        `[layout] ignoring _site.mdx ${["consent", ...(issue?.path ?? [])].join(".")}: ${issue?.message ?? "invalid"}`,
+      );
+    }
+    return undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Whether this visitor has already accepted or declined cookies (#5557).
  *
@@ -300,12 +344,15 @@ interface Props {
 }
 
 /**
- * #8847 D13 — the footer's newsletter signup: the newsletter magnet's compact
- * `NewsletterFormInline`, only when the magnet is served (live), maps as a
- * one-field signup, and the API accepts signups. The seeded built-in config
- * never fills the footer. Both reads are shared for 15 seconds per instance.
+ * #8847 D13 — the newsletter magnet's view for the footer's signup, and
+ * (#10629 D4) for every bound `newsletter` section: only when the magnet is
+ * served (live), maps as a one-field signup, and the API accepts signups. The
+ * seeded built-in config never fills either. Both reads are shared for 15
+ * seconds per instance.
  */
-async function footerNewsletter(locale: string): Promise<ReactElement | undefined> {
+async function servedNewsletterView(
+  locale: string,
+): Promise<(InPageView & { form: NewsletterFormView }) | undefined> {
   const [magnet, status] = await Promise.all([
     readServedMagnet(NEWSLETTER_FLOW_SLUG),
     readCaptureStatus(),
@@ -313,11 +360,7 @@ async function footerNewsletter(locale: string): Promise<ReactElement | undefine
   if (magnet === null || status?.newsletter !== true) return undefined;
   const view = inPageView(magnet, locale, "newsletter");
   if (view === null || !("kind" in view.form)) return undefined;
-  return (
-    <div data-testid="footer-newsletter">
-      {newsletterSignup({ ...view, form: view.form }, { locale, compact: true })}
-    </div>
-  );
+  return { ...view, form: view.form };
 }
 
 export default async function LocaleLayout({
@@ -336,6 +379,11 @@ export default async function LocaleLayout({
   // #7742 D3/D5 — the minimal chrome: the closing slide, the hairline consent
   // bar and the cue offset.
   const isMinimalChrome = chrome.chromeStyle === "minimal";
+  // #10555 — `_site.mdx`'s `consent.appearance` picks the cookie notice's
+  // look; absent, the chrome does (hairline under minimal, else compact).
+  const isHairlineConsent =
+    (readConsentAppearance() ?? (isMinimalChrome ? "hairline" : "compact")) ===
+    "hairline";
   const consentDecided = await hasConsentChoice();
   // Server-side session read (#4984) — the same `auth.api.getSession` idiom
   // the `(authed)` segment guard uses, through the generated topology seam
@@ -343,7 +391,26 @@ export default async function LocaleLayout({
   // Null when signed out or auth is unset.
   const session = await readSession(await headers());
 
-  const footerSignup = await footerNewsletter(locale);
+  const newsletterView = await servedNewsletterView(locale);
+  // #8847 D13 — the footer's compact signup.
+  const footerSignup =
+    newsletterView === undefined ? undefined : (
+      <div data-testid="footer-newsletter">
+        {newsletterSignup(newsletterView, { locale, compact: true })}
+      </div>
+    );
+  // #10629 D4 — the full-size signup every bound `newsletter` section renders
+  // (as on /newsletter), with the on-submit consent gate. Both shell branches
+  // render the page under its provider, so a bound section on any page reads it.
+  const page = (
+    <NewsletterSignupProvider
+      {...(newsletterView !== undefined && {
+        signup: newsletterSignup(newsletterView, { locale, consentGate: "on-submit" }),
+      })}
+    >
+      {children}
+    </NewsletterSignupProvider>
+  );
 
   // Resolve nav labels server-side so Nav + Footer components stay
   // i18n-hook-free and are testable without a NextIntlClientProvider wrapper.
@@ -486,6 +553,22 @@ export default async function LocaleLayout({
   const deckFooterActions = session
     ? [{ labelKey: "account", path: "/account", variant: "outline-strong" as const }]
     : [...authActions];
+  // #10550 D4 — the closing footer's site settings: its locality line, its
+  // actions (the primary, then the secondary — they replace the auth links
+  // on the closing footer in every header state) and its legal bar. The
+  // site's labels ride `itemLabels` under keys no nav key can collide with
+  // (no nav key contains a dot).
+  const closingFooter = readClosingFooterSettings();
+  const closingFooterActions = closingFooter.actions?.map(
+    (action, i) => ({
+      labelKey: `closingFooter.action.${i}`,
+      path: action.href,
+      variant: i === 0 ? ("primary" as const) : ("ghost" as const),
+    }),
+  );
+  const closingFooterLabels = Object.fromEntries(
+    (closingFooter.actions ?? []).map((action, i) => [`closingFooter.action.${i}`, action.label]),
+  );
   // A bare inner page's auth (#7721 D3/D4) rides the one-bar footer's link
   // group: Sign in / Sign up signed out, Account signed in (where Sign out
   // lives). Labels from the existing `nav` namespace. Under a full header
@@ -788,7 +871,7 @@ export default async function LocaleLayout({
              * consent Banner below. The booking paths (#8843 D10) and a magnet
              * walk (#8840 D10) take it and keep the Banner.
              */
-            children
+            page
           ) : (
             <MarketingShell
               contentOwnsMain
@@ -925,13 +1008,23 @@ export default async function LocaleLayout({
                   // #10049 D5 — the style is `pageChrome.footer`, and every
                   // footer with an actions row takes the auth links when the
                   // header is not full.
+                  // #10550 D4 — a site's own `footer.locality`, `footer.actions`
+                  // and `footer.legalBar` set the closing footer's locality line,
+                  // its actions (in place of the auth links, whatever the header)
+                  // and its legal bar.
                   {...(pageChrome.footer === "closing"
                     ? {
                         layout: "closing" as const,
-                        contactLines: readSiteContactLines(),
-                        ...(!headerIsFull && !(isHome && isMinimalChrome)
-                          ? { actions: deckFooterActions }
-                          : {}),
+                        contactLines: readSiteContactLines(closingFooter.locality),
+                        ...(closingFooterActions !== undefined
+                          ? {
+                              actions: closingFooterActions,
+                              itemLabels: { ...navLabels.items, ...closingFooterLabels },
+                            }
+                          : !headerIsFull && !(isHome && isMinimalChrome)
+                            ? { actions: deckFooterActions }
+                            : {}),
+                        ...(closingFooter.legalBar ? { legalBar: true } : {}),
                       }
                     : pageChrome.footer === "line"
                       ? { layout: "line" as const, accountLinks }
@@ -967,7 +1060,7 @@ export default async function LocaleLayout({
                 )
               }
             >
-              {children}
+              {page}
             </MarketingShell>
           )}
           {/*
@@ -996,11 +1089,11 @@ export default async function LocaleLayout({
               consentCookieName={CONSENT_COOKIE_NAME}
               consentDecided={consentDecided}
               title={tConsent("title")}
-              // #9656 D7 — the standard chrome mounts the compact floating
-              // card on every width, its Privacy Policy link on the button
-              // row; the minimal chrome keeps its hairline band (#7742 D5),
-              // the statement with the link inline.
-              {...(isMinimalChrome
+              // #9656 D7 — the compact floating card on every width, its
+              // Privacy Policy link on the button row; the hairline band
+              // (#7742 D5), the statement with the link inline. #10555 —
+              // which one is `isHairlineConsent`'s, not the chrome's.
+              {...(isHairlineConsent
                 ? {
                     message: (
                       <>
@@ -1038,12 +1131,14 @@ export default async function LocaleLayout({
               // (`CONSENT_COOKIE_NAME`) stays the operative switch the
               // island itself still writes (C3).
               locale={locale}
-              // #7742 D5 — the minimal chrome's consent bar: the page ground,
-              // a hairline, no shadow.
-              {...(isMinimalChrome ? { consentAppearance: "hairline" as const } : {})}
+              // #7742 D5 — the hairline consent bar: the page ground, a
+              // hairline, no shadow.
+              {...(isHairlineConsent ? { consentAppearance: "hairline" as const } : {})}
               // #7782 — on the minimal deck home the bar first shows once the
               // first slide has left view; every other page shows it on load.
-              {...(isDeckHome && isMinimalChrome
+              // #10721 — the bar's alone: a minimal site that picks the card
+              // (`consent.appearance: compact`) shows it on load there too.
+              {...(isDeckHome && isMinimalChrome && isHairlineConsent
                 ? { consentRevealAfter: DECK_FIRST_SLIDE_SELECTOR }
                 : {})}
             />

package/templates/apps/web/app/[locale]/thanks/[slug]/__tests__/page.test.tsx

@@ -52,10 +52,10 @@ jest.mock("../AccountInviteLink", () => ({
     }),
 }));
 
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { notFound } from "next/navigation";
-import ThankYouSlugPage from "../page";
+import ThankYouSlugPage, { generateMetadata } from "../page";
 
 const mockNotFound = notFound as jest.MockedFunction<typeof notFound>;
 
@@ -132,3 +132,22 @@ describe("ThankYouSlugPage — detail route", () => {
     expect(source).not.toMatch(/["']use client["']/);
   });
 });
+
+// #10617 AC-1 — the route's own metadata, read from the real seed, carries
+// the noindex directive the page-renderer gives every ThankYouPage.
+// The scaffold matrix runs this suite inside a scaffold that ships no
+// flow-thanks seed (#10763), so the test skips where the seed does not exist.
+const SEED = join(
+  __dirname, "..", "..", "..", "..", "..", "..", "..",
+  "content", "en", "ThankYouPage", "flow-thanks.mdx",
+);
+const itWithSeed = existsSync(SEED) ? it : it.skip;
+
+describe("ThankYouSlugPage — generateMetadata (#10617)", () => {
+  itWithSeed("carries robots noindex, follow", async () => {
+    const metadata = await generateMetadata({
+      params: Promise.resolve({ locale: "en", slug: "flow-thanks" }),
+    });
+    expect(metadata.robots).toEqual({ index: false, follow: true });
+  });
+});

package/templates/apps/web/app/[locale]/thanks/[slug]/page.tsx

@@ -4,6 +4,7 @@
 // header says why there is no static-params export (#7379). Unknown slugs 404
 // via renderPage's own detail-route branch (no translationsNamespace passed
 // — renderPage calls notFound() itself when getMdxSource resolves null).
+// `renderPageMetadata` makes every ThankYouPage `noindex, follow` (#10617).
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
 import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
 import type { Metadata } from "next";

package/templates/apps/web/app/api/auth/hub/continuation.ts

@@ -30,7 +30,10 @@ export const CONTINUATION_REF_MAX = 4096;
  */
 export const CONTINUATION_TTL_SECONDS = 600;
 
-/** A fixed name: a value sealed for a cookie never opens here, nor the reverse. */
+/**
+ * A fixed name: a value sealed for a cookie never opens here, nor the reverse.
+ * The MCP sign-in leg seals under its own name (`../mcp/continuation.ts`).
+ */
 const AAD = "hub-continue";
 
 const BASE64URL = /^[A-Za-z0-9_-]+$/;
@@ -40,12 +43,13 @@ export function mintContinuation(
   search: string,
   secret: string,
   now: number = Date.now(),
+  name: string = AAD,
 ): string {
   return seal(
     { v: 1, q: search, exp: now + CONTINUATION_TTL_SECONDS * 1000 },
     secret,
     "continue",
-    AAD,
+    name,
   );
 }
 
@@ -62,9 +66,10 @@ export function openContinuation(
   ref: string,
   secret: string,
   now: number = Date.now(),
+  name: string = AAD,
 ): string | null {
   if (ref.length > CONTINUATION_REF_MAX || !BASE64URL.test(ref)) return null;
-  const value = unseal(ref, secret, "continue", AAD);
+  const value = unseal(ref, secret, "continue", name);
   if (typeof value !== "object" || value === null) return null;
   const { v, q, exp } = value as Record<string, unknown>;
   if (v !== 1 || typeof q !== "string" || q === "") return null;

package/templates/apps/web/app/api/auth/mcp/__tests__/continuation.test.ts

@@ -0,0 +1,92 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * The MCP sign-in leg's continuation (#10479): the hub's sealed ref, under a
+ * name of its own. Pure functions over `seal.ts`; no mocks.
+ */
+import { mintContinuation } from "../../hub/continuation";
+import {
+  MCP_CONTINUE_PATH,
+  mintMcpContinuation,
+  openMcpContinuation,
+  sealMcpCallbacks,
+} from "../continuation";
+
+const SECRET = "k".repeat(43);
+const T = 1_790_000_000_000;
+
+const Q = new URLSearchParams({
+  response_type: "code",
+  client_id: "mcp-client",
+  redirect_uri: "http://127.0.0.1:53682/callback",
+  state: "s".repeat(43),
+  code_challenge: "c".repeat(43),
+  code_challenge_method: "S256",
+}).toString();
+
+it("pins the continue path", () => {
+  expect(MCP_CONTINUE_PATH).toBe("/api/auth/mcp/continue");
+});
+
+it("round-trips the authorize query, scheme-bearing redirect_uri included", () => {
+  expect(openMcpContinuation(mintMcpContinuation(Q, SECRET, T), SECRET, T + 1_000)).toBe(Q);
+});
+
+it("mints a ref no decode can change: base64url only, so no ':', '%', '?', '&' or '='", () => {
+  expect(mintMcpContinuation(Q, SECRET, T)).toMatch(/^[A-Za-z0-9_-]+$/);
+});
+
+it("expires at 600 s", () => {
+  expect(openMcpContinuation(mintMcpContinuation(Q, SECRET, T), SECRET, T + 600_000)).toBeNull();
+});
+
+it("never opens a hub ref, nor under another secret", () => {
+  expect(openMcpContinuation(mintContinuation(Q, SECRET, T), SECRET, T)).toBeNull();
+  expect(openMcpContinuation(mintMcpContinuation(Q, SECRET, T), "x".repeat(43), T)).toBeNull();
+});
+
+describe("sealMcpCallbacks — the sign-in body's MCP resume, sealed", () => {
+  const next = `/api/auth/mcp/authorize?${Q}`;
+  const refOf = (path: string | undefined) =>
+    /^\/api\/auth\/mcp\/continue\/([A-Za-z0-9_-]+)$/.exec(path ?? "")?.[1] ?? "";
+
+  it("seals callbackURL and the next inside the sign-in page's errorCallbackURL; both open to the query", () => {
+    const sealed = sealMcpCallbacks(
+      { callbackURL: next, errorCallbackURL: `/de/sign-in?next=${encodeURIComponent(next)}` },
+      SECRET,
+    );
+    expect(openMcpContinuation(refOf(sealed?.callbackURL), SECRET)).toBe(Q);
+    const error = new URL(sealed?.errorCallbackURL ?? "", "http://x.invalid");
+    expect(error.pathname).toBe("/de/sign-in");
+    expect(openMcpContinuation(refOf(error.searchParams.get("next") ?? ""), SECRET)).toBe(Q);
+    // No decode of either value can produce a ':'.
+    expect(decodeURIComponent(decodeURIComponent(sealed?.errorCallbackURL ?? ""))).not.toContain(":");
+  });
+
+  it.each([
+    ["no callbacks", {}],
+    ["an ordinary next", { callbackURL: "/account", errorCallbackURL: "/sign-in?next=%2Faccount" }],
+    ["the hub's own authorize path", { callbackURL: `/api/auth/hub/authorize?${Q}` }],
+    ["a foreign errorCallbackURL", { errorCallbackURL: `https://evil.example/?next=${encodeURIComponent(next)}` }],
+    ["a non-string callbackURL", { callbackURL: [next] }],
+    // Security review: URL's dot-segment collapse would emit //evil.example.
+    ["a dot-segment errorCallbackURL", { errorCallbackURL: `/.//evil.example?next=${encodeURIComponent(next)}` }],
+    ["an errorCallbackURL on another page", { errorCallbackURL: `/account?next=${encodeURIComponent(next)}` }],
+    ["an errorCallbackURL with a second key", { errorCallbackURL: `/sign-in?next=${encodeURIComponent(next)}&x=1` }],
+    ["a next holding CR/LF", { callbackURL: `${next}%0D%0A`.replace("%0D%0A", "\r\n") }],
+    ["an undecodable next", { errorCallbackURL: "/sign-in?next=%E0%A4%A" }],
+  ])("leaves %s alone (null)", (_name, body) => {
+    expect(sealMcpCallbacks(body, SECRET)).toBeNull();
+  });
+
+  it("seals the sign-up page's errorCallbackURL the same way", () => {
+    const sealed = sealMcpCallbacks({ errorCallbackURL: `/sign-up?next=${encodeURIComponent(next)}` }, SECRET);
+    expect(sealed?.errorCallbackURL).toMatch(/^\/sign-up\?next=%2Fapi%2Fauth%2Fmcp%2Fcontinue%2F[A-Za-z0-9_-]+$/);
+  });
+
+  it("leaves a query too long to seal under the continue route's cap as it was", () => {
+    expect(sealMcpCallbacks({ callbackURL: `${next}&state=${"s".repeat(4096)}` }, SECRET)).toBeNull();
+  });
+});

package/templates/apps/web/app/api/auth/mcp/continuation.ts

@@ -0,0 +1,89 @@
+/**
+ * The MCP sign-in leg's continuation (#10479).
+ *
+ * The plugin's `loginPage` (`lib/mcp-oauth.ts`, `/mcp/sign-in`) hands
+ * `/sign-in` a `next` of `/api/auth/mcp/authorize?<query>`, and the page sends
+ * it on as the sign-in's `callbackURL`. An MCP client's query carries a
+ * scheme-bearing `redirect_uri` (`http://127.0.0.1:PORT/callback`, any
+ * `https://` callback), and Better Auth's magic-link verify decodes
+ * `callbackURL` and checks it as a relative path whose query admits no `:` —
+ * so the emailed link answered 403 INVALID_CALLBACK_URL and the person never
+ * reached `/consent`.
+ *
+ * `auth.ts` therefore rewrites such a callback, as a sign-in request arrives,
+ * to the same-origin path `/api/auth/mcp/continue/<ref>` — the hub's sealed
+ * ref (`../hub/continuation.ts`), under a name of its own so a ref minted for
+ * one leg never opens at the other — and the continue route returns the
+ * person to `/mcp/authorize`, which forces consent again.
+ */
+import { CONTINUATION_REF_MAX, mintContinuation, openContinuation } from "../hub/continuation";
+
+/** The same-origin path a ref is appended to. */
+export const MCP_CONTINUE_PATH = "/api/auth/mcp/continue";
+
+/** The resume target the plugin's `loginPage` puts in `next`. */
+const AUTHORIZE_PREFIX = "/api/auth/mcp/authorize?";
+
+const NAME = "mcp-continue";
+
+const PRINTABLE = /^[\x21-\x7e]+$/;
+
+/**
+ * The exact `errorCallbackURL` the sign-in and sign-up pages send:
+ * `[/<locale>]/sign-in?next=<encoded>` (or `/sign-up`). Matched on the raw
+ * string and rebuilt from its own path bytes — never through `URL`, whose
+ * dot-segment collapse would turn an accepted `/.//host` into a
+ * protocol-relative `//host` after Better Auth's origin check has run.
+ */
+const SIGN_IN_ERROR_CALLBACK = /^(\/(?:[a-z]{2}(?:-[A-Za-z]{2,4})?\/)?sign-(?:in|up))\?next=([^&#]*)$/;
+
+/** `search` (the authorize query, no leading `?`) as a sealed ref. */
+export function mintMcpContinuation(search: string, secret: string, now: number = Date.now()): string {
+  return mintContinuation(search, secret, now, NAME);
+}
+
+/** The authorize query a ref holds, or `null` (see `openContinuation`). */
+export function openMcpContinuation(ref: string, secret: string, now: number = Date.now()): string | null {
+  return openContinuation(ref, secret, now, NAME);
+}
+
+/** `path` as a continue path when it resumes an MCP authorization, else unchanged. */
+function sealed(path: string, secret: string): string {
+  // Printable ASCII only, as the origin check admits: nothing sealed may hold
+  // a control or non-Latin-1 character the continue route's Location refuses.
+  if (!path.startsWith(AUTHORIZE_PREFIX) || !PRINTABLE.test(path)) return path;
+  const ref = mintMcpContinuation(path.slice(AUTHORIZE_PREFIX.length), secret);
+  // Past the cap the continue route would not open it: leave the path as it was.
+  return ref.length > CONTINUATION_REF_MAX ? path : `${MCP_CONTINUE_PATH}/${ref}`;
+}
+
+/**
+ * The sign-in body's callbacks with every MCP resume sealed, or `null` when
+ * none is: `callbackURL` itself, and the `next` the sign-in page puts inside
+ * `errorCallbackURL` (`SIGN_IN_ERROR_CALLBACK`), whose decoded form holds the
+ * same query. Every other value — any other shape included — passes through
+ * unchanged, so this hook can only ever write a same-origin continue path.
+ */
+export function sealMcpCallbacks(
+  body: { callbackURL?: unknown; errorCallbackURL?: unknown },
+  secret: string,
+): { callbackURL?: string; errorCallbackURL?: string } | null {
+  const out: { callbackURL?: string; errorCallbackURL?: string } = {};
+  if (typeof body.callbackURL === "string") {
+    const callbackURL = sealed(body.callbackURL, secret);
+    if (callbackURL !== body.callbackURL) out.callbackURL = callbackURL;
+  }
+  const match = typeof body.errorCallbackURL === "string" ? SIGN_IN_ERROR_CALLBACK.exec(body.errorCallbackURL) : null;
+  if (match) {
+    const [, page, encoded = ""] = match;
+    let next: string;
+    try {
+      next = decodeURIComponent(encoded);
+    } catch {
+      next = "";
+    }
+    const continued = sealed(next, secret);
+    if (continued !== next) out.errorCallbackURL = `${page}?next=${encodeURIComponent(continued)}`;
+  }
+  return Object.keys(out).length > 0 ? out : null;
+}

package/templates/apps/web/app/api/auth/mcp/continue/[ref]/__tests__/route.test.ts

@@ -0,0 +1,59 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * The MCP sign-in leg's continue step (#10479): a ref returns the person to
+ * `/api/auth/mcp/authorize` with the original query, and nowhere else.
+ */
+import { mintContinuation } from "../../../../hub/continuation";
+import { mintMcpContinuation } from "../../../continuation";
+import { GET } from "../route";
+
+const SITE = "https://site.example.com";
+const SECRET = "flow-secret-0123456789abcdef0123456789abcdef";
+const ORIGINAL_ENV = process.env;
+
+const QUERY = new URLSearchParams({
+  response_type: "code",
+  client_id: "mcp-client",
+  redirect_uri: "http://127.0.0.1:53682/callback",
+  state: "s".repeat(43),
+  code_challenge: "c".repeat(43),
+  code_challenge_method: "S256",
+}).toString();
+
+function continueTo(ref: string): Promise<Response> {
+  return GET(new Request(`${SITE}/api/auth/mcp/continue/${ref}`), {
+    params: Promise.resolve({ ref }),
+  });
+}
+
+beforeEach(() => {
+  process.env = { ...ORIGINAL_ENV, BETTER_AUTH_SECRET: SECRET };
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+it("answers a valid ref with 303 to /api/auth/mcp/authorize and the same query", async () => {
+  const res = await continueTo(mintMcpContinuation(QUERY, SECRET));
+
+  expect(res.status).toBe(303);
+  expect(res.headers.get("location")).toBe(`/api/auth/mcp/authorize?${QUERY}`);
+  expect(res.headers.get("cache-control")).toBe("no-store");
+  expect(res.headers.get("referrer-policy")).toBe("no-referrer");
+});
+
+it.each([
+  ["a forged ref", "not-a-ref"],
+  ["a hub ref", mintContinuation(QUERY, SECRET)],
+  ["an expired ref", mintMcpContinuation(QUERY, SECRET, Date.now() - 601_000)],
+  ["a ref sealed under another secret", mintMcpContinuation(QUERY, "x".repeat(43))],
+])("sends %s to /account, never to a URL it carries", async (_name, ref) => {
+  const res = await continueTo(ref);
+
+  expect(res.status).toBe(303);
+  expect(res.headers.get("location")).toBe("/account");
+});

package/templates/apps/web/app/api/auth/mcp/continue/[ref]/route.ts

@@ -0,0 +1,41 @@
+/**
+ * The MCP sign-in leg's continue step (#10479).
+ *
+ *   GET /api/auth/mcp/continue/<ref>
+ *
+ * After sign-in — by the emailed link, the password or a social provider —
+ * the person lands here, and this route returns them to the authorize step:
+ *
+ *   - a valid, unexpired ref: 303 to `/api/auth/mcp/authorize?<the query>`;
+ *   - any other ref (forged, a hub ref, expired, unreadable): 303 to
+ *     `/account`.
+ *
+ * Both targets are fixed relative paths: this route redirects nowhere else,
+ * and never to a URL carried in the ref. It reads no session — the authorize
+ * step does, and forces consent. It logs nothing.
+ */
+import { resolveSecret } from "../../../../../../lib/auth-secret";
+import { openMcpContinuation } from "../../continuation";
+
+const AUTHORIZE_PATH = "/api/auth/mcp/authorize";
+
+/** Where an unreadable ref goes: the site's own signed-in destination. */
+const FALLBACK_PATH = "/account";
+
+// platform-decisions-waiver: api-versioning — sign-in redirect step, not a versioned API contract (#10479)
+export async function GET(
+  _request: Request,
+  { params }: { params: Promise<{ ref: string }> },
+): Promise<Response> {
+  const { ref } = await params;
+  const query = openMcpContinuation(ref, resolveSecret());
+  return new Response(null, {
+    status: 303,
+    headers: {
+      Location: query === null ? FALLBACK_PATH : `${AUTHORIZE_PATH}?${query}`,
+      "Cache-Control": "no-store",
+      // The authorize query rides this URL; no page may leak it through a Referer.
+      "Referrer-Policy": "no-referrer",
+    },
+  });
+}