create-ailk 0.4.0 → 0.6.0

package/templates/apps/web/app/[locale]/(authed)/account/actions.ts

@@ -0,0 +1,58 @@
+"use server";
+
+/**
+ * account/actions.ts — the update-your-card banner's Server Action (#6038,
+ * D5): mints a Stripe billing-portal session on SUBMIT, never on render, and
+ * hands the browser straight to it via `redirect()`.
+ *
+ * The portal URL is never embedded in page data — it is created here, on
+ * click, and never rendered into HTML or a client bundle (D5's precise
+ * claim: `redirect()` DOES surface the target in the address bar/history/
+ * navigation telemetry for a Server Action, which is inherent to any hosted-
+ * portal handoff, not something this design avoids).
+ *
+ * CSRF is already handled: `forwardedCookieInit()` forwards the incoming
+ * request's real `Origin` alongside the cookie, and `apps/api`'s
+ * `authPreHandler` requires a matching `Origin` on this cookie-authenticated
+ * mutating request (D3.1/D5).
+ *
+ * `redirect()` throws `NEXT_REDIRECT` by design — called OUTSIDE the
+ * try/catch (mirrors `checkout.actions.ts`'s idiom) so the catch never
+ * swallows the navigation this action exists to perform.
+ */
+
+import { subscription } from "@working-theory/api-client";
+import { redirect } from "next/navigation";
+
+import { forwardedCookieInit } from "../../../../lib/server-api";
+
+/** PII-safe error identity for logs (the `checkout.actions.ts` idiom: `err.name` only). */
+function errorName(err: unknown): string {
+  return err instanceof Error ? err.name : "unknown";
+}
+
+/**
+ * Opens the caller's own Stripe billing-portal session and redirects there.
+ * Never returns on success. On a non-2xx or thrown error, logs a PII-safe
+ * status/name and redirects back to `/account` unchanged (the banner's
+ * action-unavailable posture — there is no error UI slot on this button).
+ */
+export async function openBillingPortal(): Promise<void> {
+  const init = await forwardedCookieInit();
+
+  let url: string;
+  try {
+    const res = await subscription.portalSession(init);
+    if (!res.ok) {
+      console.error(`[openBillingPortal] status=${res.status}`);
+      return;
+    }
+    url = res.body.url;
+  } catch (err) {
+    console.error(`[openBillingPortal] errName=${errorName(err)}`);
+    return;
+  }
+
+  // Outside the try/catch on purpose — see the file header.
+  redirect(url);
+}

package/templates/apps/web/app/[locale]/(authed)/account/page.tsx

@@ -1,37 +1,40 @@
 /**
- * /[locale]/account — the signed-in respondent's own profile, results, and
- * purchases (#4984).
+ * /[locale]/account — the signed-in respondent's own profile, results,
+ * purchases, and subscription status (#4984, #6038).
  *
  * RSC. The `(authed)` layout is the gate — it already resolved a session or
  * rendered `SignInGate`; this page reads the session again ONLY for the
  * profile fields (name / email / verified). Every data read goes through
  * `@working-theory/api-client` with the caller's cookie forwarded
  * (`../../../../lib/server-api`, D9): `waitlistSignups.me(key)` once per key
- * in `lib/account-config.ts` (Results) and `flowCheckouts.me()` (Purchases).
- * A 404 (no signup / no user row for that key) or a 401/403 (session missing,
- * email unverified — the profile row already says so) is skipped, never
- * thrown; every other error rethrows to the route error boundary.
+ * in `lib/account-config.ts` (Results), `flowCheckouts.me()` (Purchases),
+ * and `subscription.me()` (the update-your-card banner, #6038). A 404 (no
+ * signup / no user row for that key / commerce module off) or a 401/403
+ * (session missing, email unverified — the profile row already says so) is
+ * skipped, never thrown; every other error rethrows to the route error
+ * boundary.
  *
- * Chrome: `PortalShell` hard-codes its /portal nav and accepts only
- * `siteName` + `children`, so this composes `AppShell` + `SidebarNav`
- * directly — the same structure PortalShell itself uses — with this page's
- * own three in-page anchors. The page renders inside the locale layout
- * (which owns the marketing Nav/Footer) — the operator's decision; there is
- * no second MarketingShell here.
+ * Chrome: this page composes `AppShell` + `SidebarNav` directly, with this
+ * page's own three in-page anchors. The page renders inside the locale
+ * layout (which owns the marketing Nav/Footer) — the operator's decision;
+ * there is no second MarketingShell here.
  */
 
 import {
   flowCheckouts,
+  subscription,
   waitlistSignups,
   type FlowCheckoutMeItem,
+  type SubscriptionMeResponse,
   type WaitlistSignupMeResponse,
 } from "@working-theory/api-client";
 import { AppShell } from "@working-theory/templates/shells";
 import { localeHref } from "@working-theory/ui";
-import { DescriptionList } from "@working-theory/ui/blocks";
+import { DescriptionList, SubscriptionStatusBanner } from "@working-theory/ui/blocks";
 import { SidebarNav, type SidebarNavItem } from "@working-theory/ui/chrome";
 import {
   Badge,
+  Button,
   EmptyState,
   Heading,
   MoneyAmount,
@@ -55,6 +58,7 @@ import { forwardedCookieInit, unwrapApiResult } from "../../../../lib/server-api
 import { ForbiddenState } from "../waitlist/components/ForbiddenState";
 import { formatCount, formatDateTime } from "../waitlist/format";
 
+import { openBillingPortal } from "./actions";
 import { SignOutButton } from "./sign-out-button";
 
 interface Props {
@@ -95,6 +99,19 @@ async function readCheckouts(init: CookieInit): Promise<FlowCheckoutMeItem[]> {
   return unwrapApiResult(Promise.resolve(res));
 }
 
+/**
+ * The update-your-card banner's read (#6038). `null` covers both "nothing
+ * to show" (401/403/404 — the commerce-disabled-build 404 included, D8) and
+ * "no row" (a healthy subscriber, `actionRequired: false`) — the page's
+ * render condition below is `sub?.actionRequired`, so both collapse to no
+ * banner without a separate branch.
+ */
+async function readSubscription(init: CookieInit): Promise<SubscriptionMeResponse | null> {
+  const res = await subscription.me(init);
+  if (!res.ok && SKIPPED_STATUSES.has(res.status)) return null; // AC-4, the existing constant
+  return unwrapApiResult(Promise.resolve(res));
+}
+
 export default async function AccountPage({ params }: Props): Promise<ReactElement> {
   const { locale } = await params;
   const t = await getTranslations({ locale, namespace: "account" });
@@ -114,7 +131,11 @@ export default async function AccountPage({ params }: Props): Promise<ReactEleme
   }
 
   const init = await forwardedCookieInit();
-  const [signups, checkouts] = await Promise.all([readSignups(init), readCheckouts(init)]);
+  const [signups, checkouts, sub] = await Promise.all([
+    readSignups(init),
+    readCheckouts(init),
+    readSubscription(init),
+  ]);
 
   const { name, email, emailVerified } = session.user;
   const displayName = name || email;
@@ -147,6 +168,38 @@ export default async function AccountPage({ params }: Props): Promise<ReactEleme
           </Text>
         </div>
 
+        {sub?.actionRequired ? (
+          <SubscriptionStatusBanner
+            headline={t("subscription.headline")}
+            description={
+              sub.status === "canceled" && sub.accessRevokesAt
+                ? t("subscription.descriptionCanceled", {
+                    date: formatDateTime(sub.accessRevokesAt, locale),
+                  })
+                : t("subscription.descriptionPastDue")
+            }
+            tone={sub.status === "canceled" ? "error" : "warning"}
+            action={
+              sub.portalAvailable ? (
+                <form action={openBillingPortal}>
+                  {/* variant="unstyled" + text-current/border-current, not variant="secondary" —
+                      a per-mode-fixed color fails contrast against the banner's warning/error
+                      fill in dark mode (design-review F4); size="big" for the 44px touch-target
+                      floor this is a mobile CTA under (design-review F5, Rule 14). */}
+                  <Button
+                    type="submit"
+                    variant="unstyled"
+                    size="big"
+                    className="rounded-control border-thin border-current bg-transparent px-control-x text-current hover:opacity-90 active:opacity-80"
+                  >
+                    {t("subscription.action")}
+                  </Button>
+                </form>
+              ) : undefined
+            }
+          />
+        ) : null}
+
         <section id="profile" className="flex flex-col gap-4" data-testid="account-profile">
           <Heading level={2}>{t("profile.heading")}</Heading>
           <DescriptionList

package/templates/apps/web/app/[locale]/(authed)/layout.tsx

@@ -2,7 +2,7 @@
  * (authed) segment layout — the operator-dashboard session guard (#4665 D9).
  *
  * RSC: reads the active Better Auth session via `auth.api.getSession`
- * (mirrors `apps-paid/workspace/app/(authed)/layout.tsx`). With no session it
+ * (mirrors `apps-paid/admin/app/(authed)/layout.tsx`). With no session it
  * renders `SignInGate` — the dashboard's own front door — rather than
  * redirecting (a `redirect("/sign-in")` would render the visitor's requested
  * path only as a query param; rendering the gate in place keeps the URL, and
@@ -50,5 +50,22 @@ export default async function AuthedLayout({
     );
   }
 
-  return <>{children}</>;
+  // data-profile="app" puts the Pro-host editor surfaces in this group on
+  // @working-theory/theme's app profile (#5953); tokens.css's own
+  // [data-profile="app"] header documents what it overrides. The div carries
+  // no className and no layout of its own — it exists only because this
+  // layout returns a fragment and the attribute needs an element.
+  //
+  // Two things about the placement are deliberate. Only the SIGNED-IN branch
+  // carries it: SignInGate above is the marketing site's sign-in front door,
+  // not an app surface. And the attribute goes on this nested div rather than
+  // the app's <html> because apps/web's marketing routes share that root and
+  // must stay on the marketing profile — which also makes this half immune to
+  // the `:root` shadowing the Admin host hit (different element, no
+  // specificity tie, so the app values apply and inherit down).
+  return (
+    <div data-profile="app" data-testid="authed-profile-root">
+      {children}
+    </div>
+  );
 }

package/templates/apps/web/app/[locale]/(authed)/leads/__tests__/page.test.tsx

@@ -0,0 +1,181 @@
+/**
+ * Tests for the signed-in owner's lead inbox (#5678 Deliverable 2).
+ *
+ * Covers:
+ *   1. Renders one row per lead, with a `null` name shown as the
+ *      "unavailable" sentinel rather than blank.
+ *   2. Renders the forward-only "next" link when `nextCursor` is present, and
+ *      omits it when it is `null`.
+ *   3. Forwards `?cursor=` from `searchParams` to the api-client call.
+ *   4. Renders an EmptyState — not a headerless table — for an empty page.
+ *   5. Renders ForbiddenState on a 401/403; falls back to the first page
+ *      when a supplied `?cursor=` 400s; rethrows every other error.
+ */
+import { render, screen } from "@testing-library/react";
+
+jest.mock("next-intl/server", () => ({
+  __esModule: true,
+  getTranslations: jest.fn().mockImplementation(async () => (key: string, values?: Record<string, unknown>) =>
+    values ? `copy:${key}:${JSON.stringify(values)}` : `copy:${key}`,
+  ),
+}));
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue(new Headers()),
+  cookies: jest.fn().mockResolvedValue({ toString: () => "session=abc" }),
+}));
+
+const mockList = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  leads: { list: (...args: unknown[]) => mockList(...args) },
+}));
+
+import Page from "../page";
+
+const FIXTURE_PAGE = {
+  items: [
+    {
+      id: "lead_1",
+      name: "Ada Lovelace",
+      email: "ada@example.com",
+      source: "web",
+      createdAt: "2026-09-01T10:00:00.000Z",
+    },
+    {
+      id: "lead_2",
+      name: null,
+      email: "anon@example.com",
+      source: "conversational-intake",
+      createdAt: "2026-08-31T09:00:00.000Z",
+    },
+  ],
+  nextCursor: null as string | null,
+};
+
+function renderPage(cursor?: string) {
+  return Page({
+    params: Promise.resolve({ locale: "en" }),
+    searchParams: Promise.resolve(cursor ? { cursor } : {}),
+  });
+}
+
+describe("LeadsInboxPage", () => {
+  beforeEach(() => {
+    mockList.mockReset();
+  });
+
+  it("renders one row per lead, with email and source", async () => {
+    mockList.mockResolvedValue({ ok: true, body: FIXTURE_PAGE });
+    render(await renderPage());
+
+    expect(screen.getByTestId("leads-inbox-page")).toBeInTheDocument();
+    const first = screen.getByTestId("leads-table-row-lead_1");
+    expect(first).toHaveTextContent("Ada Lovelace");
+    expect(first).toHaveTextContent("ada@example.com");
+    expect(first).toHaveTextContent("web");
+    expect(screen.getByTestId("leads-table-row-lead_2")).toHaveTextContent(
+      "conversational-intake",
+    );
+    expect(screen.getAllByTestId(/^leads-table-row-/)).toHaveLength(2);
+  });
+
+  it("renders a null name as the unavailable sentinel", async () => {
+    mockList.mockResolvedValue({ ok: true, body: FIXTURE_PAGE });
+    render(await renderPage());
+
+    expect(screen.getByTestId("leads-table-row-lead_2")).toHaveTextContent(
+      "copy:table.unavailable",
+    );
+  });
+
+  it("omits the next link when nextCursor is null", async () => {
+    mockList.mockResolvedValue({ ok: true, body: FIXTURE_PAGE });
+    render(await renderPage());
+
+    expect(screen.queryByTestId("leads-table-next")).not.toBeInTheDocument();
+  });
+
+  it("renders the next link pointing at the next cursor", async () => {
+    mockList.mockResolvedValue({
+      ok: true,
+      body: { ...FIXTURE_PAGE, nextCursor: "lead_2" },
+    });
+    render(await renderPage());
+
+    const next = screen.getByTestId("leads-table-next");
+    expect(next).toBeInTheDocument();
+    expect(next).toHaveAttribute("href", "/en/leads?cursor=lead_2");
+  });
+
+  it("forwards ?cursor= to the api-client call", async () => {
+    mockList.mockResolvedValue({ ok: true, body: FIXTURE_PAGE });
+    render(await renderPage("lead_9"));
+
+    expect(mockList).toHaveBeenCalledWith(
+      { cursor: "lead_9" },
+      expect.objectContaining({ headers: expect.objectContaining({ cookie: "session=abc" }) }),
+    );
+  });
+
+  it("renders an EmptyState when the owner has no leads", async () => {
+    mockList.mockResolvedValue({ ok: true, body: { items: [], nextCursor: null } });
+    render(await renderPage());
+
+    expect(screen.getByTestId("leads-table-empty")).toBeInTheDocument();
+    expect(screen.queryByTestId("leads-table")).not.toBeInTheDocument();
+  });
+
+  it("renders ForbiddenState on a 401 rather than throwing", async () => {
+    mockList.mockResolvedValue({
+      ok: false,
+      status: 401,
+      body: { error: { code: "unauthorized", message: "Unauthorized" } },
+    });
+    render(await renderPage());
+
+    expect(screen.getByTestId("waitlist-forbidden")).toBeInTheDocument();
+  });
+
+  it("rethrows a non-401/403 error", async () => {
+    mockList.mockResolvedValue({
+      ok: false,
+      status: 500,
+      body: { error: { code: "internal_error", message: "Boom" } },
+    });
+    await expect(renderPage()).rejects.toThrow();
+  });
+
+  // PR #5705 security review, finding 3.
+  it("falls back to the first page when a supplied ?cursor= 400s", async () => {
+    mockList
+      .mockResolvedValueOnce({
+        ok: false,
+        status: 400,
+        body: {
+          error: {
+            code: "validation_failed",
+            message: "cursor does not resolve within this scope",
+          },
+        },
+      })
+      .mockResolvedValueOnce({ ok: true, body: FIXTURE_PAGE });
+
+    render(await renderPage("lead_gone"));
+
+    expect(screen.getByTestId("leads-table")).toBeInTheDocument();
+    expect(mockList).toHaveBeenNthCalledWith(1, { cursor: "lead_gone" }, expect.anything());
+    expect(mockList).toHaveBeenNthCalledWith(2, {}, expect.anything());
+  });
+
+  it("rethrows a 400 on the FIRST page — there is no cursor to blame", async () => {
+    mockList.mockResolvedValue({
+      ok: false,
+      status: 400,
+      body: { error: { code: "validation_failed", message: "Invalid query parameters" } },
+    });
+    await expect(renderPage()).rejects.toThrow();
+    expect(mockList).toHaveBeenCalledTimes(1);
+  });
+});

package/templates/apps/web/app/[locale]/(authed)/leads/components/LeadsTable.tsx

@@ -0,0 +1,137 @@
+/**
+ * LeadsTable — the lead inbox's paginated table (#5678 Deliverable 2).
+ *
+ * App-local composition: `Table` primitive + `EmptyState` when there are no
+ * rows + a single forward-only "next page" link. Every string is
+ * caller-supplied (translatable) and every value arrives pre-formatted — this
+ * component formats nothing itself (Rule 10: formatting happens in the page,
+ * via `../../waitlist/format.js`).
+ *
+ * Deliberately NOT an import of the structurally identical
+ * `../../waitlist/components/SignupsTable.tsx`, despite sharing its shape:
+ * that file is an `ownedFiles` entry of a PAID module slice
+ * (`packages/create-ailk/src/module-architecture.ts` — the
+ * `apps/web/app/[locale]/(authed)/waitlist/**` block, which belongs to the
+ * `multi-tenant` slice, not `signal-collectors` as the card's brief had it;
+ * verified at HEAD, the `SignupsTable.tsx` entry is on line 1035 inside
+ * `MODULE_SLICES["multi-tenant"].ownedFiles`). A scaffold built without that
+ * module has no such file. Lead capture — and therefore this inbox — ships at
+ * every level including Free, so importing it would make a base-tier page
+ * depend on a file the strip removes. The pattern is reused; the file is not.
+ *
+ * `EmptyState`-when-empty follows `ExperimentsTable`'s idiom rather than
+ * `SignupsTable`'s (which always renders a table): a headerless table is not
+ * an acceptable empty state for a page whose whole body is this one table.
+ *
+ * `ForbiddenState` and `format.ts`, by contrast, are safe to import: both are
+ * deliberately EXCLUDED from that same `ownedFiles` list (see the module
+ * file's own ESCALATION comment above the list — they are shared with the
+ * Free `(authed)/account` page, which already imports both), so both survive
+ * in a build without the paid slice.
+ */
+
+import type { LeadInboxRow } from "@working-theory/api-client";
+import {
+  EmptyState,
+  Link,
+  Table,
+  TableBody,
+  TableCaption,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@working-theory/ui/primitives";
+import type { ReactElement } from "react";
+
+export interface LeadsTableLabels {
+  caption: string;
+  columnName: string;
+  columnEmail: string;
+  columnSource: string;
+  columnCreated: string;
+  unavailable: string;
+  next: string;
+  emptyHeadline: string;
+  emptyDescription: string;
+}
+
+export interface LeadsTableProps {
+  locale: string;
+  /**
+   * `created` is pre-formatted by the caller (Rule 10 — this component never
+   * formats a value itself). `lead.name` is `null` when the capture form took
+   * no name; it renders `labels.unavailable`, the same sentinel handling the
+   * caller's own `format.ts` uses elsewhere on the authed surface.
+   *
+   * There is no page/URL column: the `Lead` record persists no page or
+   * referrer field, so `source` is the only capture-origin signal.
+   */
+  rows: Array<{
+    lead: LeadInboxRow;
+    created: string;
+  }>;
+  nextCursor: string | null;
+  labels: LeadsTableLabels;
+}
+
+function buildNextHref(locale: string, nextCursor: string): string {
+  const params = new URLSearchParams();
+  params.set("cursor", nextCursor);
+  return `/${locale}/leads?${params.toString()}`;
+}
+
+export function LeadsTable({
+  locale,
+  rows,
+  nextCursor,
+  labels,
+}: LeadsTableProps): ReactElement {
+  if (rows.length === 0) {
+    return (
+      <div data-testid="leads-table-empty">
+        <EmptyState headline={labels.emptyHeadline} description={labels.emptyDescription} />
+      </div>
+    );
+  }
+
+  return (
+    <div data-testid="leads-table-wrapper">
+      <Table data-testid="leads-table">
+        <TableCaption>{labels.caption}</TableCaption>
+        <TableHeader>
+          <TableRow>
+            <TableHead scope="col">{labels.columnName}</TableHead>
+            <TableHead scope="col">{labels.columnEmail}</TableHead>
+            <TableHead scope="col">{labels.columnSource}</TableHead>
+            <TableHead scope="col">{labels.columnCreated}</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {rows.map(({ lead, created }) => (
+            <TableRow key={lead.id} data-testid={`leads-table-row-${lead.id}`}>
+              <TableCell>{lead.name ?? labels.unavailable}</TableCell>
+              <TableCell>{lead.email}</TableCell>
+              <TableCell>{lead.source}</TableCell>
+              <TableCell>{created}</TableCell>
+            </TableRow>
+          ))}
+        </TableBody>
+      </Table>
+      {nextCursor !== null ? (
+        <div className="mt-3 flex justify-end">
+          <Link
+            href={buildNextHref(locale, nextCursor)}
+            data-testid="leads-table-next"
+            // 24px hit-area floor (Rule 14) — a bare inline link's
+            // line-height box falls short on its own (#4665, caught on the
+            // worker's own re-inspection of the render evidence).
+            className="inline-flex min-h-6 items-center px-2"
+          >
+            {labels.next}
+          </Link>
+        </div>
+      ) : null}
+    </div>
+  );
+}

package/templates/apps/web/app/[locale]/(authed)/leads/page.tsx

@@ -0,0 +1,111 @@
+/**
+ * /[locale]/leads — the signed-in site owner's lead inbox (#5678).
+ *
+ * RSC: reads `GET /v1/leads` through `@working-theory/api-client`'s `leads`
+ * namespace, forwarding the caller's cookie session
+ * (`../../../../lib/server-api`, #4665 D9) — never a hand-rolled `fetch`
+ * (`architecture.yaml`: `apps/web` may not reach `apps/api` directly). The
+ * route is owner-scoped server-side, so this page passes no site or workspace
+ * argument; the only query it owns is the forward-only `?cursor=`.
+ *
+ * A 401/403 renders `ForbiddenState` (no leak of why — the same shape the
+ * waitlist comparison page uses); every other error (a 400 on a malformed
+ * cursor, a 500) rethrows to the route's error boundary rather than being
+ * swallowed.
+ */
+
+import { leads, type LeadInboxPage } from "@working-theory/api-client";
+import { PageHeader } from "@working-theory/ui/blocks";
+import { Container, Heading, Text } from "@working-theory/ui/primitives";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { ApiError, forwardedCookieInit, unwrapApiResult } from "../../../../lib/server-api";
+import { ForbiddenState } from "../waitlist/components/ForbiddenState";
+import { formatDateTime } from "../waitlist/format";
+
+import { LeadsTable } from "./components/LeadsTable";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  searchParams: Promise<{ cursor?: string }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "leadsInbox" });
+  return { title: t("title"), description: t("description") };
+}
+
+export default async function LeadsInboxPage({
+  params,
+  searchParams,
+}: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  const { cursor } = await searchParams;
+  const t = await getTranslations({ locale, namespace: "leadsInbox" });
+
+  const init = await forwardedCookieInit();
+
+  let page: LeadInboxPage;
+  try {
+    page = await unwrapApiResult(leads.list(cursor ? { cursor } : {}, init));
+  } catch (err) {
+    if (err instanceof ApiError && (err.status === 401 || err.status === 403)) {
+      return (
+        <ForbiddenState
+          headline={t("forbiddenHeadline")}
+          description={t("forbiddenDescription")}
+        />
+      );
+    }
+    // A 400 means the `?cursor=` in the URL did not resolve — it was typed,
+    // or it is a stale next-page link whose row has since gone. That is a bad
+    // address, not a broken page, so fall back to the first page rather than
+    // letting it reach the route's error boundary (PR #5705 security review,
+    // finding 3). A 400 from the FIRST-page read has no cursor to blame and
+    // would be a genuine contract break, so it is rethrown.
+    if (err instanceof ApiError && err.status === 400 && cursor) {
+      page = await unwrapApiResult(leads.list({}, init));
+    } else {
+      throw err;
+    }
+  }
+
+  const rows = page.items.map((lead) => ({
+    lead,
+    created: formatDateTime(lead.createdAt, locale),
+  }));
+
+  return (
+    <main className="min-h-screen bg-surface text-fg" data-testid="leads-inbox-page">
+      <PageHeader />
+      <Container className="flex flex-col gap-6 py-section">
+        <div>
+          <Heading level={1}>{t("title")}</Heading>
+          <Text as="p" variant="body-sm" tone="muted" className="mt-1">
+            {t("description")}
+          </Text>
+        </div>
+
+        <LeadsTable
+          locale={locale}
+          rows={rows}
+          nextCursor={page.nextCursor}
+          labels={{
+            caption: t("table.caption"),
+            columnName: t("table.columnName"),
+            columnEmail: t("table.columnEmail"),
+            columnSource: t("table.columnSource"),
+            columnCreated: t("table.columnCreated"),
+            unavailable: t("table.unavailable"),
+            next: t("table.next"),
+            emptyHeadline: t("table.emptyHeadline"),
+            emptyDescription: t("table.emptyDescription"),
+          }}
+        />
+      </Container>
+    </main>
+  );
+}

package/templates/apps/web/app/[locale]/(authed)/sign-in-gate.tsx

@@ -4,7 +4,7 @@
  * SignInGate — the `(authed)` group's own front door (#4665 D9).
  *
  * This gate composes the shipped `AuthPanel` section directly (so the
- * dashboard is reachable in place, unlike `apps-paid/workspace`, which redirects
+ * dashboard is reachable in place, unlike `apps-paid/admin`, which redirects
  * to "/" on no session) and ALSO links to `apps/web`'s own `/sign-in` page
  * (#4984) carrying `?next=<pathname>`, so a visitor who prefers the full
  * sign-in surface lands back on the exact page they requested.