create-ailk 0.31.0 → 0.33.0

package/templates/apps/web/app/[locale]/flows/[slug]/verify.actions.ts

@@ -0,0 +1,151 @@
+// oss: false
+"use server";
+
+/**
+ * confirmLeadEmailAction — a person's confirm of a magnet Lead's emailed link
+ * (#10826, spec docs/specs/10826-the-four-conversions-as-completion-spec.md
+ * D5). The one place that link's nonce is spent.
+ *
+ * The page's GET (`verify/page.tsx`) renders a button and writes nothing, so a
+ * mail scanner or a link preview that fetches the link verifies nothing; only
+ * a person's POST reaches here. In order:
+ *
+ *   1. Every bound argument is re-validated (SEC-10826-6) — a direct call can
+ *      set any of them: `slug` against `flowSlugSchema`, `leadId` against the
+ *      id shape, `nonce` at 1–256 characters, `locale` against the enabled
+ *      locales. A refusal makes no API call.
+ *   2. The per-visitor limit (5 per 10 minutes) and the bot check, before any
+ *      API call, because the API sees only this site's server address.
+ *   3. `flows.verifyLead`, forwarding the visitor's address (SEC-10826-8).
+ *   4. A redirect: a `user` magnet's verified Lead to the sign-up landing
+ *      (`accountInviteHref`), a `lead-link` landing when it is a plain
+ *      site-relative path (SEC-10826-5), else the confirmed card; everything
+ *      else to the error card.
+ *
+ * The nonce is never in a redirect URL and never logged here. No MCP twin
+ * (`WEB_ONLY_ACTIONS` in `apps/mcp/__tests__/parity.test.ts`): it spends an
+ * address credential only the mailbox holder has.
+ */
+
+import { flows } from "@working-theory/api-client";
+import { localeHref } from "@working-theory/ui";
+import { flowSlugSchema } from "@working-theory/validation";
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+
+import { accountInviteHref } from "../../../../lib/account-invite";
+import { runBotCheck } from "../../../../lib/bot-check";
+import { takeVisitorLimit } from "../../../../src/lib/rate-limit";
+
+const CONFIRM_LIMIT = 5;
+const CONFIRM_WINDOW_MS = 10 * 60 * 1000;
+const NO_HEADERS = { get: () => null };
+
+const LEAD_ID_RE = /^lead_[0-9a-f-]{36}$/;
+const NONCE_MAX = 256;
+
+const DEFAULT_LOCALE = "en";
+const ENABLED_LOCALES = (
+  process.env.NEXT_PUBLIC_ENABLED_LOCALES ?? DEFAULT_LOCALE
+).split(",");
+
+/**
+ * SEC-10826-5 — a landing is followed only when it is one `/` followed by
+ * neither `/` nor a backslash, with no backslash anywhere: a site-relative
+ * path, never `//host`, `/\host` or an absolute URL.
+ */
+function isSitePath(landing: string): boolean {
+  // One leading `/`, then no `/` or backslash; no backslash, whitespace or
+  // control character anywhere — a browser strips TAB/CR/LF, so `/\t/host`
+  // would otherwise become `//host` (security review, #10826).
+  return /^\/(?![/\\])[^\\\s\p{Cc}]*$/u.test(landing);
+}
+
+type Answer = { kind: "confirmed"; to: string | null } | { kind: "refused" };
+
+async function confirm(
+  slug: string,
+  leadId: string,
+  nonce: string,
+  locale: string,
+): Promise<Answer> {
+  let requestHeaders: Awaited<ReturnType<typeof headers>> | undefined;
+  try {
+    requestHeaders = await headers();
+  } catch {
+    // No request scope to read — the shared unknown-visitor bucket.
+  }
+  const limit = takeVisitorLimit(
+    "flowverify",
+    requestHeaders ?? NO_HEADERS,
+    CONFIRM_LIMIT,
+    CONFIRM_WINDOW_MS,
+  );
+  if (!limit.allowed) return { kind: "refused" };
+
+  const bot = await runBotCheck({
+    source: "flow-verify",
+    target: "confirmLeadEmailAction",
+    scope: "write",
+  });
+  if (bot !== "pass") return { kind: "refused" };
+
+  const visitorIp =
+    requestHeaders?.get("x-forwarded-for") ?? requestHeaders?.get("x-real-ip");
+  try {
+    const res = visitorIp
+      ? await flows.verifyLead(
+          slug,
+          { leadId, nonce },
+          { headers: { "x-forwarded-for": visitorIp } },
+        )
+      : await flows.verifyLead(slug, { leadId, nonce });
+    if (!res.ok) return { kind: "refused" };
+    const { outcome, landing, signUpEmail } = res.body;
+    if (outcome !== "verified" && outcome !== "already_verified")
+      return { kind: "refused" };
+    if (typeof signUpEmail === "string") {
+      const href = accountInviteHref(locale, signUpEmail);
+      if (href !== null) return { kind: "confirmed", to: href };
+    }
+    if (typeof landing === "string" && isSitePath(landing)) {
+      return { kind: "confirmed", to: localeHref(locale, landing) };
+    }
+    return { kind: "confirmed", to: null };
+  } catch {
+    return { kind: "refused" };
+  }
+}
+
+/**
+ * Bound by the page — `confirmLeadEmailAction.bind(null, slug, leadId, nonce,
+ * locale)` — so no hidden input carries the nonce; the form's own data is
+ * ignored.
+ */
+export async function confirmLeadEmailAction(
+  slug: string,
+  leadId: string,
+  nonce: string,
+  locale = DEFAULT_LOCALE,
+): Promise<never> {
+  const slugOk = flowSlugSchema.safeParse(slug).success;
+  const localeOk = ENABLED_LOCALES.includes(locale);
+  const safeLocale = localeOk ? locale : DEFAULT_LOCALE;
+  // An unreadable slug has no confirm page of its own to land on.
+  const page = slugOk ? `/flows/${slug}/verify` : "/";
+  const errorHref = localeHref(safeLocale, `${page}?error=invalid`);
+
+  const argumentsOk =
+    slugOk &&
+    localeOk &&
+    typeof leadId === "string" &&
+    LEAD_ID_RE.test(leadId) &&
+    typeof nonce === "string" &&
+    nonce.length >= 1 &&
+    nonce.length <= NONCE_MAX;
+  if (!argumentsOk) redirect(errorHref);
+
+  const answer = await confirm(slug, leadId, nonce, safeLocale);
+  if (answer.kind === "refused") redirect(errorHref);
+  redirect(answer.to ?? localeHref(safeLocale, `${page}?confirmed=1`));
+}

package/templates/apps/web/app/[locale]/meet/confirmed/BookingHandOff.tsx

@@ -5,7 +5,7 @@
  * BookingHandOff — `/meet/confirmed`'s booked time and Slack next step
  * (#9853 D10). The booker writes one `sessionStorage` item before it
  * navigates here (`BOOKING_CONFIRMATION_STORAGE_KEY`); this reads it once and
- * removes it, the `/thanks` page's `AccountInviteLink` pattern, so the page's
+ * removes it, the read-once hand-off pattern, so the page's
  * address carries nothing about the booking and a later visit shows nothing.
  *
  * It renders only an item written for this page (`to`'s path, without its

package/templates/apps/web/app/[locale]/pricing/[slug]/__tests__/page.test.tsx

@@ -32,6 +32,9 @@ jest.mock("next/navigation", () => ({
 
 import OfferingPricingPage, { dynamic, generateMetadata } from "../page";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 const SLUG = "website-rebuild";
 const SITE_EMAIL = "hello@example.com";
 

package/templates/apps/web/app/[locale]/pricing/__tests__/offerings.test.tsx

@@ -27,6 +27,9 @@ import {
 
 import PricingPage, { generateMetadata } from "../page";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 const SITE_EMAIL = "hello@example.com";
 const HOSTILE = "</script><script>alert(1)</script>";
 

package/templates/apps/web/app/[locale]/pricing/__tests__/page.test.tsx

@@ -15,6 +15,9 @@ import { act, render, screen, within } from "@testing-library/react";
 
 import PricingPage from "../page";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 const PLANS = [
   {
     key: "basic",

package/templates/apps/web/app/[locale]/pricing/__tests__/unconnected.test.tsx

@@ -27,6 +27,9 @@ import { TOPOLOGY } from "../../../../lib/topology.generated";
 import * as pricingPage from "../page";
 import PricingPage, { generateMetadata } from "../page";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 const PLANS = [
   {
     key: "basic",

package/templates/apps/web/app/[locale]/projects/__tests__/page-renderer-migration.test.tsx

@@ -51,6 +51,9 @@ import { notFound } from "next/navigation";
 import ProjectsPage from "../page";
 import ProjectSlugPage from "../[slug]/page";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 const mockNotFound = notFound as jest.MockedFunction<typeof notFound>;
 
 // ── Shared stub helpers ────────────────────────────────────────────────────────

package/templates/apps/web/app/[locale]/services/__tests__/page-renderer-migration.test.tsx

@@ -31,6 +31,9 @@ import ServicesPage from "../page";
 import ServiceSlugPage from "../[slug]/page";
 import * as pageRenderer from "@working-theory/page-renderer";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 const mockNotFound = notFound as jest.MockedFunction<typeof notFound>;
 
 // ── Shared stub helpers ────────────────────────────────────────────────────────

package/templates/apps/web/app/[locale]/team/__tests__/team-routes.test.tsx

@@ -31,6 +31,9 @@ import TeamPage from "../page";
 import TeamMemberPage from "../[slug]/page";
 import * as pageRenderer from "@working-theory/page-renderer";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 type JsonLd = Record<string, unknown>;
 
 function jsonLdScripts(container: HTMLElement): JsonLd[] {

package/templates/apps/web/app/[locale]/thanks/[slug]/__tests__/page.test.tsx

@@ -37,20 +37,6 @@ jest.mock("@working-theory/ui", () => ({
     }),
 }));
 
-// #8771 D6 — the page reads the link label on the server and renders the client
-// component that owns the hand-off; this file asserts only that wiring.
-jest.mock("next-intl/server", () => ({
-  getTranslations: jest.fn().mockResolvedValue((key: string) => `label:${key}`),
-}));
-// eslint-disable-next-line no-restricted-syntax -- the page's wiring is the unit under test; the component has its own suite
-jest.mock("../AccountInviteLink", () => ({
-  AccountInviteLink: ({ thanksSlug, label }: { thanksSlug: string; label: string }) =>
-    React.createElement("div", {
-      "data-testid": "account-invite-link",
-      "data-slug": thanksSlug,
-      "data-label": label,
-    }),
-}));
 
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -111,7 +97,7 @@ describe("ThankYouSlugPage — detail route", () => {
     expect(mockNotFound).toHaveBeenCalled();
   });
 
-  it("renders AccountInviteLink with the route's slug and the contact label (#8771)", async () => {
+  it("renders no account hand-off: a user magnet's walk lands on sign-up itself (#10826 D6)", async () => {
     const getMdxSource = jest.fn().mockResolvedValue(makeThankYouSource("flow-thanks"));
 
     const element = await ThankYouSlugPage({
@@ -120,11 +106,8 @@ describe("ThankYouSlugPage — detail route", () => {
     });
     const { container } = render(element);
 
-    const link = container.querySelector('[data-testid="account-invite-link"]');
-    // Inside the page's own <main>, not after it (#8771 design review).
-    expect(link?.closest("main")).not.toBeNull();
-    expect(link).toHaveAttribute("data-slug", "flow-thanks");
-    expect(link).toHaveAttribute("data-label", "label:trackInAccount");
+    expect(container.querySelector('[data-testid="account-invite-link"]')).toBeNull();
+    expect(existsSync(join(__dirname, "..", "AccountInviteLink.tsx"))).toBe(false);
   });
 
   it("stays a server page: the module has no client directive (#8771)", () => {

package/templates/apps/web/app/[locale]/thanks/[slug]/page.tsx

@@ -8,11 +8,8 @@
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
 import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
 import type { Metadata } from "next";
-import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
-import { AccountInviteLink } from "./AccountInviteLink";
-
 interface Props {
   params: Promise<{ locale: string; slug: string }>;
   getMdxSource?: typeof defaultGetMdxSource;
@@ -30,17 +27,13 @@ export default async function Page({
   getMdxSource,
 }: Props): Promise<ReactElement> {
   const { locale, slug } = await params;
-  // #8771 D6 — the magnet walk's "Track this in your account" hand-off. The
-  // page stays a server page; the client component decides if it has a link.
-  // It renders through `trailing`, inside the page's own <main>, so it keeps
-  // the page's landmark and layout rather than sitting after `</main>`.
-  const t = await getTranslations({ locale, namespace: "contact" });
+  // #10826 D6 — no account hand-off: a `user` magnet's walk lands on sign-up
+  // itself, so the walk writes no `/thanks` link any more.
   return renderPage({
     type: "ThankYouPage",
     slug,
     locale,
     populatedDescriptionTestId: "thank-you-description",
-    trailing: <AccountInviteLink thanksSlug={slug} label={t("trackInAccount")} />,
     ...(getMdxSource !== undefined && { getMdxSource }),
   });
 }

package/templates/apps/web/auth.ts

@@ -63,14 +63,23 @@ import {
 const RESET_TOKEN_TTL_SECONDS = 3600;
 
 /**
- * Verification-token lifetime (§ D11). Twenty-four hours. Unlike the reset
- * token this is NOT a credential — it is a signed JWT whose blast radius is
- * `emailVerified: true` on one row — so its failure mode is a person who
- * opened the mail next morning having to ask again. The library's 3600 s
- * default is too short for that; a day is not.
+ * Verification-link lifetime (§ D11). Twenty-four hours — the API's
+ * `EMAIL_VERIFICATION_TTL_MS.user` (#10820), whose single-use link the hook
+ * sends; Better Auth still reads this to decide when to call it. A person who
+ * opened the mail next morning should not have to ask again.
  */
 const VERIFY_TOKEN_TTL_SECONDS = 86_400;
 
+/**
+ * Better Auth's own `GET /verify-email` (#10820 D4), disabled on EVERY build.
+ * Its stateless JWT is neither single-use nor revocable, and it stamps
+ * `emailVerified` on a valid signature; the API's email-verification service
+ * is the one verifier now, reached from the site's `/verify-email` page by a
+ * person's click. The magic-link verify is `/magic-link/verify`, a distinct
+ * path, and is unaffected.
+ */
+const VERIFY_EMAIL_DISABLED_PATHS = ["/verify-email"];
+
 // mcp-oauth:begin
 /**
  * The site's MCP authorization server (#10357 D4): better-auth's `mcp` plugin
@@ -510,6 +519,10 @@ export function createAuth(deps: CreateAuthDeps = {}) {
   });
   const sendVerificationEmail = makeSendVerificationEmail({
     send: authEmailTransport,
+    // The site's own confirm page, on the same pinned origin the reset links
+    // use (#10820 D4). The callback is registered only under
+    // `resetConfigured`, which requires that origin.
+    confirmBase: baseURL ? new URL("/verify-email", baseURL).href : "",
   });
   const sendPasswordChangedNotice = makeSendPasswordChangedNotice({
     send: authEmailTransport,
@@ -709,7 +722,10 @@ export function createAuth(deps: CreateAuthDeps = {}) {
      * deployment that has not pinned its origin never offers reset at all.
      */
     ...(baseURL ? { trustedOrigins: [baseURL] } : {}),
-    ...(baseURL ? { disabledPaths: MCP_DISABLED_PATHS } : {}),
+    disabledPaths: [
+      ...VERIFY_EMAIL_DISABLED_PATHS,
+      ...(baseURL ? MCP_DISABLED_PATHS : []),
+    ],
     emailAndPassword: {
       enabled: passwordMethodActive,
       // Turning the password method on also opens POST /sign-up/email —

package/templates/apps/web/lib/__tests__/account-config.test.ts

@@ -36,6 +36,7 @@ const mockSubscriptionMe = jest.fn();
 const mockMemberPieces = jest.fn();
 const mockMemberMessages = jest.fn();
 const mockMemberPurchases = jest.fn();
+const mockMemberResults = jest.fn();
 const mockMemberAppointments = jest.fn();
 const mockMemberMeetingTypes = jest.fn();
 const mockMemberRequestForm = jest.fn();
@@ -48,6 +49,7 @@ jest.mock("@working-theory/api-client", () => ({
     pieces: (...args: unknown[]) => mockMemberPieces(...args),
     messages: (...args: unknown[]) => mockMemberMessages(...args),
     purchases: (...args: unknown[]) => mockMemberPurchases(...args),
+    results: (...args: unknown[]) => mockMemberResults(...args),
     appointments: (...args: unknown[]) => mockMemberAppointments(...args),
     meetingTypes: (...args: unknown[]) => mockMemberMeetingTypes(...args),
     requestForm: (...args: unknown[]) => mockMemberRequestForm(...args),
@@ -148,6 +150,11 @@ const MESSAGE = {
 const ok = <T>(body: T) => ({ ok: true as const, body });
 const fail = (status: number) => ({ ok: false as const, status, body: null });
 
+beforeEach(() => {
+  // A site with no workspace module answers the results read 404.
+  mockMemberResults.mockResolvedValue(fail(404));
+});
+
 afterEach(() => {
   jest.clearAllMocks();
   accountExperimentKeys.length = 0;
@@ -256,6 +263,68 @@ describe("result — waitlistSignups.me per accountExperimentKeys", () => {
   });
 });
 
+describe("result — member.results, a User's pending link (#10826 D7, AC-2)", () => {
+  const RESULT = {
+    id: "lead_01920000-0000-7000-8000-000000000001",
+    magnetSlug: "request-quote",
+    title: "Request a quote",
+    submittedAt: "2026-11-02T09:00:00.000Z",
+    href: "/flows/request-quote/results/eyJ2ZXJzaW9uIjoxfQ",
+  };
+  const ITEM = { id: RESULT.id, title: "Request a quote", at: RESULT.submittedAt, data: RESULT };
+
+  it("loads member.results items as rows with the forwarded init, beside the signups", async () => {
+    accountExperimentKeys.push("diag");
+    mockSignupMe.mockResolvedValue(ok(SIGNUP));
+    mockMemberResults.mockResolvedValue(ok({ items: [RESULT] }));
+    const items = await kind("result").load(ctx());
+    expect(mockMemberResults).toHaveBeenCalledWith(INIT);
+    expect(items).toEqual([
+      { id: "diag", title: "diag", at: SIGNUP.completedAt, data: SIGNUP },
+      ITEM,
+    ]);
+  });
+
+  it("loads none on a 404 (no workspace module)", async () => {
+    mockMemberResults.mockResolvedValue(fail(404));
+    await expect(kind("result").load(ctx())).resolves.toEqual([]);
+  });
+
+  it("loads none on a 403 while the email is unverified, and rejects on a 503", async () => {
+    mockMemberResults.mockResolvedValue(fail(403));
+    await expect(kind("result").load(ctx({ emailVerified: false }))).resolves.toEqual([]);
+    mockMemberResults.mockResolvedValue(fail(503));
+    await expect(kind("result").load(ctx())).rejects.toThrow();
+  });
+
+  it("details the magnet's title and submitted date, with an Open action to its href", () => {
+    const detail = kind("result").renderDetail(ITEM, ctx());
+    expect(detail.fields?.heading).toBe("t:results.heading");
+    expect(detail.fields?.items.map((i) => i.label)).toEqual([
+      "t:results.magnet",
+      "t:results.submittedAt",
+    ]);
+    expect(detail.fields?.items[0]?.value).toBe("Request a quote");
+    expect(detail.actions).toEqual([
+      {
+        key: "open-result",
+        label: "t:results.open",
+        variant: "default",
+        href: "/flows/request-quote/results/eyJ2ZXJzaW9uIjoxfQ",
+      },
+    ]);
+  });
+
+  it("still details a waitlist signup as before", () => {
+    const detail = kind("result").renderDetail(
+      { id: "diag", title: "diag", at: SIGNUP.completedAt, data: SIGNUP },
+      ctx(),
+    );
+    expect(detail.actions).toBeUndefined();
+    expect(detail.fields?.items[0]).toEqual({ label: "t:results.experiment", value: "diag" });
+  });
+});
+
 describe("purchase — member.purchases (#8231 D5)", () => {
   const ITEM = { id: "pur_1", title: "Pro plan", at: PURCHASE.purchasedAt, data: PURCHASE };
 

package/templates/apps/web/lib/__tests__/auth-email.test.ts

@@ -20,9 +20,12 @@
  *     change it reports.
  */
 
+import { createHmac } from "node:crypto";
+
 import type { AuthEmailLog } from "../auth-email";
 import {
   buildAuthEmailRequest,
+  confirmSignUpEmail,
   MAGIC_LINK_TTL_SECONDS,
   makeMagicLinkOptions,
   makeSendResetPassword,
@@ -246,7 +249,11 @@ describe("the § D12 PII boundary", () => {
     const reset = makeSendResetPassword({ prisma: makePrisma(true), send, log });
     await reset({ user: { id: "user_1", email: "person@example.com" }, url });
 
-    const verify = makeSendVerificationEmail({ send, log });
+    const verify = makeSendVerificationEmail({
+      send,
+      log,
+      confirmBase: "https://site.example/verify-email",
+    });
     await verify({ user: { id: "user_1", email: "person@example.com" }, url });
 
     const notice = makeSendPasswordChangedNotice({ send, log });
@@ -727,3 +734,94 @@ describe("sendMagicLink — the sign-up kind (#9720 D6)", () => {
     });
   });
 });
+
+// ── #10820 — one email-verification service ──────────────────────────────
+
+describe("makeSendVerificationEmail (#10820 D4)", () => {
+  it("posts the site's confirm base as `url`, never Better Auth's JWT link", async () => {
+    process.env.AUTH_EMAIL_WEBHOOK_SECRET = "test-secret";
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { log } = makeLog();
+    const confirmBase = "https://site.example/verify-email";
+    const verify = makeSendVerificationEmail({ send, log, confirmBase });
+
+    await verify({
+      user: { id: "user_1", email: "person@example.com" },
+      url: "https://site.example/api/auth/verify-email?token=JWT",
+    });
+
+    expect(send).toHaveBeenCalledTimes(1);
+    const [rawBody] = send.mock.calls[0] as [string];
+    const body = JSON.parse(rawBody) as Record<string, unknown>;
+    expect(body).toEqual({
+      kind: "email-verification",
+      userId: "user_1",
+      to: "person@example.com",
+      url: confirmBase,
+      expiresInMinutes: 1440,
+    });
+    expect(rawBody).not.toContain("JWT");
+  });
+});
+
+describe("confirmSignUpEmail (#10820 D7)", () => {
+  const NONCE = "N".repeat(43);
+
+  beforeEach(() => {
+    process.env.AUTH_EMAIL_WEBHOOK_SECRET = "test-secret";
+  });
+
+  it("signs the domain-separated base string over the exact bytes it sends", async () => {
+    const confirm = jest
+      .fn()
+      .mockResolvedValue({ ok: true, body: { ok: true, outcome: "verified" } });
+    const { log } = makeLog();
+
+    expect(await confirmSignUpEmail(NONCE, { confirm, log })).toBe("verified");
+
+    const [rawBody, headers] = confirm.mock.calls[0] as [string, Record<string, string>];
+    expect(rawBody).toBe(JSON.stringify({ nonce: NONCE }));
+    const timestamp = headers["x-ailk-auth-email-timestamp"]!;
+    expect(headers["x-ailk-auth-email-signature"]).toBe(
+      `sha256=${createHmac("sha256", "test-secret")
+        .update(`email-verification-confirm.${timestamp}.${rawBody}`, "utf8")
+        .digest("hex")}`,
+    );
+  });
+
+  it.each(["verified", "already_verified", "expired", "invalid"])(
+    "hands back the hop's %s outcome",
+    async (outcome) => {
+      const confirm = jest.fn().mockResolvedValue({ ok: true, body: { ok: true, outcome } });
+      expect(await confirmSignUpEmail(NONCE, { confirm, log: makeLog().log })).toBe(outcome);
+    },
+  );
+
+  it("answers failed — never throwing — on a non-2xx, an unknown body, a throw or no secret", async () => {
+    const { log } = makeLog();
+    const rejected = jest.fn().mockResolvedValue({ ok: false, status: 401, body: null });
+    const odd = jest.fn().mockResolvedValue({ ok: true, body: { outcome: "stamped" } });
+    const throwing = jest.fn().mockRejectedValue(new Error("boom"));
+    expect(await confirmSignUpEmail(NONCE, { confirm: rejected, log })).toBe("failed");
+    expect(await confirmSignUpEmail(NONCE, { confirm: odd, log })).toBe("failed");
+    expect(await confirmSignUpEmail(NONCE, { confirm: throwing, log })).toBe("failed");
+    delete process.env.AUTH_EMAIL_WEBHOOK_SECRET;
+    const unused = jest.fn();
+    expect(await confirmSignUpEmail(NONCE, { confirm: unused, log })).toBe("failed");
+    expect(unused).not.toHaveBeenCalled();
+  });
+
+  it("never logs the nonce", async () => {
+    const { lines, log } = makeLog();
+    await confirmSignUpEmail(NONCE, {
+      confirm: jest.fn().mockResolvedValue({ ok: true, body: { ok: true, outcome: "verified" } }),
+      log,
+    });
+    await confirmSignUpEmail(NONCE, {
+      confirm: jest.fn().mockRejectedValue(new Error(NONCE)),
+      log,
+    });
+    expect(lines.length).toBeGreaterThan(0);
+    expect(JSON.stringify(lines)).not.toContain(NONCE);
+  });
+});

package/templates/apps/web/lib/__tests__/page-chrome.test.ts

@@ -29,6 +29,9 @@ import {
 } from "../page-chrome";
 import type { SiteChrome } from "../site-chrome";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 // ── AC-2 — the route families ────────────────────────────────────────────
 
 function camel(prefix: string): string {