create-ailk 0.3.0 → 0.4.0

package/site-templates/marketing-site-free/content/en/TermsPage/terms.mdx

@@ -0,0 +1,80 @@
+---
+type: "TermsPage"
+slug: "terms"
+title: "Terms of Service"
+description: "Placeholder terms of service for Your Company. Replace every section with terms that describe what you actually offer before you launch."
+sections:
+  [
+    {
+      "id": "terms-document",
+      "type": "document-chassis",
+      "data":
+        {
+          "eyebrow": "PLACEHOLDER — REPLACE BEFORE LAUNCH",
+          "headline": "Terms of Service",
+          "backHref": "/",
+          "backLabel": "Back home",
+          "navGroupLabel": "Contents",
+          "sections":
+            [
+              {
+                "id": "placeholder-notice",
+                "heading": "This is placeholder text",
+                "blocks":
+                  [
+                    {
+                      "kind": "paragraph",
+                      "text": "This page is starter content that shipped with your site. It is not a contract, it binds nobody, and it is not legal advice. Replace every section below with terms that match what Your Company actually offers, and have someone qualified read them before you publish.",
+                    },
+                    {
+                      "kind": "paragraph",
+                      "text": "Until you do, leave this notice in place so nobody mistakes the page for finished terms.",
+                    },
+                  ],
+              },
+              {
+                "id": "what-to-write-here",
+                "heading": "What belongs on this page",
+                "blocks":
+                  [
+                    {
+                      "kind": "paragraph",
+                      "text": "Terms of service set out who is offering what, on what conditions. Write each part about the thing you actually sell, and keep the sentences short enough that a customer can follow them.",
+                    },
+                    {
+                      "kind": "list",
+                      "listStyle": "number",
+                      "items":
+                        [
+                          "Who provides the service, and which legal entity stands behind it.",
+                          "What the service is, and what it is not.",
+                          "What a customer may and may not do with it.",
+                          "How payment, renewal and cancellation work, if you charge.",
+                          "Which warranties you give, and which you do not.",
+                          "Which law governs the agreement, and how you will announce changes.",
+                        ],
+                    },
+                  ],
+              },
+              {
+                "id": "contact",
+                "heading": "Questions about these terms",
+                "blocks":
+                  [
+                    {
+                      "kind": "paragraph",
+                      "text": "Replace this with the address you actually monitor — for example hello@example.com — so a customer with a question about the terms has somewhere to send it.",
+                    },
+                    {
+                      "kind": "paragraph",
+                      "text": "Replace this with the date these terms last changed, and say what happens when they change again.",
+                    },
+                  ],
+              },
+            ],
+        },
+    },
+  ]
+---
+
+{/* Rendered from frontmatter `sections[]`. Placeholder seed content — these are not terms of service and not legal advice. Replace every section before you launch. */}

package/site-templates/marketing-site-free/provenance.json

@@ -0,0 +1,4 @@
+{
+  "template": "marketing-site-free",
+  "requires": ["marketing"]
+}

package/templates/apps/api/src/__tests__/workspace-module-registration.test.ts

@@ -0,0 +1,166 @@
+/**
+ * @file workspace-module-registration.test.ts
+ * @description The `workspace || multi-tenant` registration matrix (#5371 D2).
+ *
+ * `workspace` cannot be folded into the sibling `module-exclusion.test.ts`:
+ * that suite's shape is "excluding module X 404s every route X owns", and the
+ * three routes here register under EITHER module, so excluding `workspace`
+ * while `multi-tenant` is on leaves them registered by design. That is the
+ * whole point of D2's gate, so it gets its own matrix.
+ *
+ * The three cases §5.1 names:
+ *
+ *   1. workspace only      — the three workspace-settings routes resolve for a
+ *                            single-tenant session; billing / workspace-session
+ *                            / org routes stay unregistered.
+ *   2. multi-tenant only   — everything resolves exactly as it did before this
+ *                            change (the regression floor).
+ *   3. both enabled        — each of workspaceConfigRoutes /
+ *                            workspaceGeneralRoutes / workspaceMembersRoutes
+ *                            registers exactly ONCE; Fastify throws on a
+ *                            duplicate route at build() time, so a successful
+ *                            build IS the assertion, backed by an explicit
+ *                            count over the router tree.
+ *
+ * "Resolves" is measured as "not Fastify's own 404". An unauthenticated
+ * request to a registered tenant route answers 401, never 404, so the two
+ * states are unambiguous — the same signal `module-exclusion.test.ts` uses.
+ *
+ * Mirrors `src/__tests__/server.test.ts`'s external-boundary mocks (CORS,
+ * rate-limit, email) — see that file's header for why each is mocked.
+ */
+
+jest.mock('@fastify/cors', () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock('@fastify/rate-limit', () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock('@working-theory/email', () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
+}));
+
+import { build } from '../server';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
+type App = any;
+
+const WS = 'wksp_00000000-0000-7000-8000-0000000000aa';
+
+/** The routes the widened gate must serve under EITHER module. */
+const SHARED_TENANT_ROUTES = [
+  { method: 'GET' as const, url: `/v1/workspaces/${WS}/theme` },
+  { method: 'GET' as const, url: `/v1/workspaces/${WS}/identity` },
+  { method: 'GET' as const, url: `/v1/workspaces/${WS}/seo` },
+  { method: 'GET' as const, url: `/v1/workspaces/${WS}/general` },
+  { method: 'GET' as const, url: `/v1/workspaces/${WS}/members` },
+];
+
+/** Routes that must stay multi-tenant-only — the gate's other half. */
+const MULTI_TENANT_ONLY_ROUTES = [
+  { method: 'GET' as const, url: '/v1/workspaces' },
+  { method: 'GET' as const, url: '/v1/billing' },
+  { method: 'GET' as const, url: '/v1/waitlist-experiments' },
+];
+
+async function withEnabledModules<T>(
+  enabled: string,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const prior = process.env.AILK_ENABLED_MODULES;
+  process.env.AILK_ENABLED_MODULES = enabled;
+  try {
+    return await fn();
+  } finally {
+    if (prior === undefined) {
+      delete process.env.AILK_ENABLED_MODULES;
+    } else {
+      process.env.AILK_ENABLED_MODULES = prior;
+    }
+  }
+}
+
+/** Every (method, path) pair Fastify's router holds, one per line. */
+function routeLines(app: App): string[] {
+  return (app.printRoutes({ commonPrefix: false }) as string)
+    .split('\n')
+    .map((line: string) => line.trim())
+    .filter(Boolean);
+}
+
+describe('workspace-settings registration matrix (#5371 D2)', () => {
+  let app: App;
+
+  afterEach(async () => {
+    if (app) {
+      await app.close();
+      app = undefined;
+    }
+    delete process.env.AILK_ENABLED_MODULES;
+  });
+
+  it("with 'workspace' enabled and 'multi-tenant' disabled, the five settings routes resolve", async () => {
+    app = await withEnabledModules('workspace', () => build());
+
+    for (const { method, url } of SHARED_TENANT_ROUTES) {
+      const res = await app.inject({ method, url });
+      expect({ url, status: res.statusCode }).toEqual({ url, status: 401 });
+    }
+  });
+
+  it("with 'workspace' alone, billing / workspace-session / org routes stay unregistered", async () => {
+    app = await withEnabledModules('workspace', () => build());
+
+    for (const { method, url } of MULTI_TENANT_ONLY_ROUTES) {
+      const res = await app.inject({ method, url });
+      expect({ url, status: res.statusCode }).toEqual({ url, status: 404 });
+    }
+  });
+
+  it("with 'multi-tenant' enabled and 'workspace' disabled, every route resolves as before", async () => {
+    app = await withEnabledModules('multi-tenant', () => build());
+
+    for (const { method, url } of [
+      ...SHARED_TENANT_ROUTES,
+      ...MULTI_TENANT_ONLY_ROUTES,
+    ]) {
+      const res = await app.inject({ method, url });
+      expect({ url, status: res.statusCode }).not.toEqual({ url, status: 404 });
+    }
+  });
+
+  it('with BOTH enabled, each shared route registers exactly once', async () => {
+    // build() itself is the first assertion: Fastify throws
+    // FST_ERR_DUPLICATED_ROUTE at registration time, so a double-registration
+    // never reaches the router tree to be counted.
+    app = await withEnabledModules('workspace,multi-tenant', () => build());
+
+    const lines = routeLines(app);
+    for (const segment of ['theme', 'identity', 'seo', 'general', 'members']) {
+      const matches = lines.filter((line) => line.includes(segment));
+      expect({ segment, count: matches.length }).toEqual({
+        segment,
+        count: 1,
+      });
+    }
+
+    for (const { method, url } of [
+      ...SHARED_TENANT_ROUTES,
+      ...MULTI_TENANT_ONLY_ROUTES,
+    ]) {
+      const res = await app.inject({ method, url });
+      expect({ url, status: res.statusCode }).not.toEqual({ url, status: 404 });
+    }
+  });
+
+  it('with neither enabled, none of the five settings routes registers', async () => {
+    app = await withEnabledModules('', () => build());
+
+    for (const { method, url } of SHARED_TENANT_ROUTES) {
+      const res = await app.inject({ method, url });
+      expect({ url, status: res.statusCode }).toEqual({ url, status: 404 });
+    }
+  });
+});

package/templates/apps/api/src/config/modules.ts

@@ -9,7 +9,7 @@
  * means the same (the OSS-strip build target); a list enables exactly the
  * modules it names.
  *
- * Recognized module keys: `docs`, `multi-tenant`, `scheduling`,
+ * Recognized module keys: `docs`, `multi-tenant`, `workspace`, `scheduling`,
  * `signal-collectors`, `commerce` (the `ModuleName` vocabulary
  * `packages/create-ailk/src/module-architecture.ts` already models via
  * `MODULE_SLICES`) plus `content-write` — the Pro

package/templates/apps/api/src/server.ts

@@ -130,6 +130,8 @@ import {
 const WORKSPACES_INDEX = "./routes/workspaces/index.js";
 const WORKSPACES_SESSIONS = "./routes/workspaces/sessions.js";
 const WORKSPACES_CONFIG = "./routes/workspaces/config.js";
+const WORKSPACES_GENERAL = "./routes/workspaces/general.js";
+const WORKSPACES_MEMBERS = "./routes/workspaces/members.js";
 const BILLING_INDEX = "./routes/billing/index.js";
 const WAITLIST_EXPERIMENTS_INDEX = "./routes/waitlist-experiments/index.js";
 const CONTENT_CREATE = "./routes/content/create.js";
@@ -171,6 +173,14 @@ const SLICE_PLUGINS = {
     specifier: WORKSPACES_CONFIG,
     load: () => import(WORKSPACES_CONFIG),
   },
+  workspaceGeneralRoutes: {
+    specifier: WORKSPACES_GENERAL,
+    load: () => import(WORKSPACES_GENERAL),
+  },
+  workspaceMembersRoutes: {
+    specifier: WORKSPACES_MEMBERS,
+    load: () => import(WORKSPACES_MEMBERS),
+  },
   billingRoutes: {
     specifier: BILLING_INDEX,
     load: () => import(BILLING_INDEX),
@@ -568,9 +578,6 @@ export async function build() {
           await sliceRoutePlugin("workspaceSessionRoutes"),
         );
         await tenantScope.register(await sliceRoutePlugin("sessionRoutes"));
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceConfigRoutes"),
-        );
         // Org-billing routes (#3701) — org-scoped read + Stripe customer-portal.
         await tenantScope.register(await sliceRoutePlugin("billingRoutes"));
         // Waitlist operator-dashboard read API (#4665 D7, B0) — tenant-scoped
@@ -585,6 +592,42 @@ export async function build() {
         await tenantScope.register(projectListingTenantRoutes);
       });
     }
+
+    // Workspace SETTINGS routes — a sibling tenant scope, gated on EITHER
+    // module (#5371 D2). The site-config routes were registered inside the
+    // multi-tenant scope above, which was too narrow: nothing in their logic
+    // is multi-tenant-specific, and since Phase 2 `resolveActiveTenant`
+    // resolves a single-tenant session's TenantContext from the default
+    // Organization/Workspace exactly like a multi-tenant one. Widening the
+    // gate is the correction; duplicating the route file would encode the
+    // original mis-scoping twice.
+    //
+    // This is a REGISTRATION change, not a tenant-isolation change: the scope
+    // registers its own `tenantPreHandlerSlicePlugin()`, the same default-deny
+    // guard the scope above uses, with the same `resolveActiveTenant` behind
+    // it. Every other route in that scope (workspaceSessionRoutes,
+    // sessionRoutes, billingRoutes, waitlistExperimentRoutes, the
+    // project-listings tenant routes) stays multi-tenant-only.
+    //
+    // A build with BOTH modules enabled registers each of the three route
+    // plugins exactly once: they live here and nowhere else, so the two
+    // scopes cannot collide on a path.
+    if (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")) {
+      await authScope.register(async (tenantScope) => {
+        await tenantScope.register(await tenantPreHandlerSlicePlugin());
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceConfigRoutes"),
+        );
+        // The Pro workspace module's own two routes (#5371): the workspace
+        // name, and the read-only member roster.
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceGeneralRoutes"),
+        );
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceMembersRoutes"),
+        );
+      });
+    }
   });
 
   // Public routes — no auth required.

package/templates/apps/web/app/[locale]/pricing/page.tsx

@@ -0,0 +1,40 @@
+// Pricing page. Reads the Pricing MDX frontmatter, renders sections via
+// SectionRenderer, and emits a JSON-LD <script>.
+import type {
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections} from "@working-theory/page-renderer";
+import {
+  renderPage,
+  renderPageMetadata
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+}
+
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "Pricing", slug: "pricing", locale });
+}
+
+export default async function Page({
+  params,
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  return renderPage({
+    type: "Pricing",
+    slug: "pricing",
+    locale,
+    translationsNamespace: "pricing",
+    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(getPageSections !== undefined && { getPageSections }),
+  });
+}

package/templates/apps/web/app/[locale]/privacy/page.tsx

@@ -0,0 +1,40 @@
+// Privacy page. Reads the PrivacyPage MDX frontmatter, renders sections via
+// SectionRenderer, and emits a JSON-LD <script>.
+import type {
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections} from "@working-theory/page-renderer";
+import {
+  renderPage,
+  renderPageMetadata
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+}
+
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "PrivacyPage", slug: "privacy", locale });
+}
+
+export default async function Page({
+  params,
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  return renderPage({
+    type: "PrivacyPage",
+    slug: "privacy",
+    locale,
+    translationsNamespace: "privacy",
+    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(getPageSections !== undefined && { getPageSections }),
+  });
+}

package/templates/apps/web/app/[locale]/terms/page.tsx

@@ -0,0 +1,40 @@
+// Terms page. Reads the TermsPage MDX frontmatter, renders sections via
+// SectionRenderer, and emits a JSON-LD <script>.
+import type {
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections} from "@working-theory/page-renderer";
+import {
+  renderPage,
+  renderPageMetadata
+} from "@working-theory/page-renderer";
+import type { Metadata } from "next";
+import type { ReactElement } from "react";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+}
+
+export async function generateMetadata({
+  params,
+}: Pick<Props, "params">): Promise<Metadata> {
+  const { locale } = await params;
+  return renderPageMetadata({ type: "TermsPage", slug: "terms", locale });
+}
+
+export default async function Page({
+  params,
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  return renderPage({
+    type: "TermsPage",
+    slug: "terms",
+    locale,
+    translationsNamespace: "terms",
+    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(getPageSections !== undefined && { getPageSections }),
+  });
+}

package/templates/apps/web/jest.config.cjs

@@ -92,6 +92,11 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/site-config/dist/schema/index.js",
     "^@working-theory/validation$": "<rootDir>/node_modules/@working-theory/validation/dist/index.js",
     "^@working-theory/web-i18n$": "<rootDir>/node_modules/@working-theory/web-i18n/dist/index.js",
+    // The dependency-free tenancy-constants subpath (database/tenancy.ts —
+    // it imports only a type from @working-theory/ids). Mapped to source like
+    // every sibling above; `database/dist` is not built in this workspace
+    // pre-`pnpm build`.
+    "^@working-theory/database/tenancy$": "<rootDir>/node_modules/@working-theory/database/dist/tenancy.js",
     // #5025: pnpm keys next-intl's virtual-store path on its resolved peers,
     // so apps/web and packages/page-renderer can link two PHYSICALLY DISTINCT
     // copies of the same version — and a `jest.mock("next-intl/server")` in

package/templates/apps/web/lib/__tests__/server-api.test.ts

@@ -0,0 +1,61 @@
+/**
+ * Tests for `forwardedCookieInit` — the RSC cookie/origin-forwarding helper
+ * (#5371 shepherd fix-up).
+ *
+ * Contract: the returned `init.headers` always carries the forwarded
+ * `cookie`, and carries `origin` ONLY when the incoming request's `Origin`
+ * header is present — never a fabricated value. This is what lets a Server
+ * Action `PUT`/`PATCH` through `@working-theory/api-client`'s `workspace.*`
+ * namespace pass `apps/api`'s same-origin CSRF check (`isOriginAllowed`),
+ * which Node's server-side `fetch` cannot satisfy on its own since it never
+ * sets `Origin`.
+ */
+import { forwardedCookieInit } from "../server-api";
+
+const mockCookies = jest.fn();
+const mockHeaders = jest.fn();
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  cookies: (...args: unknown[]) => mockCookies(...args),
+  headers: (...args: unknown[]) => mockHeaders(...args),
+}));
+
+describe("forwardedCookieInit", () => {
+  beforeEach(() => {
+    mockCookies.mockReset();
+    mockHeaders.mockReset();
+  });
+
+  it("forwards cookie + origin when the incoming request carries an Origin header", async () => {
+    mockCookies.mockResolvedValue({
+      toString: () => "better-auth.session_token=abc",
+    });
+    mockHeaders.mockResolvedValue(
+      new Headers({ origin: "https://app.example.com" }),
+    );
+
+    const init = await forwardedCookieInit();
+
+    expect(init).toEqual({
+      headers: {
+        cookie: "better-auth.session_token=abc",
+        origin: "https://app.example.com",
+      },
+    });
+  });
+
+  it("forwards cookie alone — no origin key at all — when Origin is absent", async () => {
+    mockCookies.mockResolvedValue({
+      toString: () => "better-auth.session_token=abc",
+    });
+    mockHeaders.mockResolvedValue(new Headers());
+
+    const init = await forwardedCookieInit();
+
+    expect(init).toEqual({
+      headers: { cookie: "better-auth.session_token=abc" },
+    });
+    expect(init.headers).not.toHaveProperty("origin");
+  });
+});

package/templates/apps/web/lib/server-api.ts

@@ -3,22 +3,26 @@
  * (#4665 D9).
  *
  * Forwards the incoming request's cookies to `@working-theory/api-client`'s
- * `waitlistExperiments` namespace (B0, #4671) so `apps/api`'s cookie-session
- * auth preHandler resolves the SAME Better Auth session the browser holds —
- * both apps share the session store. GETs only, every page is an RSC; there
- * is no client fetch and no `NEXT_PUBLIC_` credential (D9).
+ * `waitlistExperiments` / `workspace` namespaces (B0, #4671; #5371) so
+ * `apps/api`'s cookie-session auth preHandler resolves the SAME Better Auth
+ * session the browser holds — both apps share the session store. Every page
+ * is an RSC and every write is a Server Action; there is no client fetch and
+ * no `NEXT_PUBLIC_` credential (D9). For a Server Action `PUT`/`PATCH`, the
+ * incoming request's `Origin` is forwarded alongside the cookie so
+ * `apps/api`'s same-origin CSRF check (`isOriginAllowed`) passes — Node's
+ * server-side `fetch` never sets `Origin` on its own.
  *
  * `apps/web` may not import `apps/api` directly (architecture.yaml) — every
- * read goes through `@working-theory/api-client`'s typed namespace, never a
+ * call goes through `@working-theory/api-client`'s typed namespace, never a
  * hand-rolled `fetch`. This module supplies exactly the two things that
- * namespace doesn't own: the cookie-forwarding `init` (B0's additive
+ * namespace doesn't own: the cookie/origin-forwarding `init` (B0's additive
  * `init?: { headers }` on `http.get`) and the envelope→`ApiError` unwrap
  * (mirrors `apps-paid/workspace/lib/api-error.ts`'s `unwrapEnvelope`, adapted to
  * the `@working-theory/api-client` `ApiResult<T>` shape B0 already returns
  * rather than re-parsing the wire envelope by hand).
  */
 
-import { cookies } from "next/headers";
+import { cookies, headers } from "next/headers";
 
 /**
  * Structural mirror of `@working-theory/api-client`'s `ApiResult<T>`
@@ -57,15 +61,27 @@ interface ErrorBody {
 }
 
 /**
- * Forward the incoming request's cookies as the `init` every
- * `waitlistExperiments.*` call accepts. Call once per request — `cookies()`
- * reads the current RSC request context.
+ * Forward the incoming request's cookies — and, when present, its `Origin` —
+ * as the `init` every `waitlistExperiments.*` / `workspace.*` call accepts.
+ * Call once per request — `cookies()` / `headers()` read the current RSC
+ * request context.
+ *
+ * The `Origin` forward matters for every non-GET call: `apps/api`'s
+ * `authPreHandler` (`isOriginAllowed`) requires a matching `Origin` header on
+ * a cookie-authenticated mutating request, and Node's server-side `fetch`
+ * (unlike a browser XHR/fetch) never sets one on its own. A Server Action's
+ * incoming request DOES carry the browser's real `Origin`, so re-forwarding
+ * it here — rather than fabricating one — lets a genuine same-origin write
+ * pass the check exactly as a browser-originated one would. RSC `GET`s are
+ * unaffected: `isOriginAllowed` short-circuits `true` for safe methods before
+ * it ever inspects the header.
  */
 export async function forwardedCookieInit(): Promise<{
-  headers: { cookie: string };
+  headers: { cookie: string; origin?: string };
 }> {
   const cookieHeader = (await cookies()).toString();
-  return { headers: { cookie: cookieHeader } };
+  const origin = (await headers()).get("origin");
+  return { headers: { cookie: cookieHeader, ...(origin ? { origin } : {}) } };
 }
 
 /**