Replace Core UI server actions with Better Call API

apps/test-web/README.md

@@ -178,9 +178,21 @@ pnpm --filter test-web build
 
 CI also runs package typechecks and builds for `@hackkit/core`, `@hackkit/config`, `@hackkit/next`, `@hackkit/ui`, `@hackkit/plugin-teams`, `@hackkit/plugin-discord`, and `@hackkit/plugin-notifications-email`.
 
-## Server Actions
-
-UI mutations live on the Next runtime (`runtime.mutations` from `createHackKitMutations`). Named server actions and the `hackKitUIActions` provider map ship from `@hackkit/next` — [`app/providers.tsx`](app/providers.tsx) passes `hackKitUIActions` to `HackKitUIProvider`. Plugin actions remain generated in [`app/hackkit-plugin-actions.ts`](app/hackkit-plugin-actions.ts) by `hackkit plugin sync`.
+## Core UI API boundary
+
+Core UI mutations are served by the static Better Call registry on
+`/api/hackkit`; [`app/api/hackkit/[...all]/route.ts`](app/api/hackkit/[...all]/route.ts)
+is only a Web Request → Next route adapter. The client-side
+[`app/providers.tsx`](app/providers.tsx) creates the typed
+`HackKitUIActions` client from `@hackkit/next/client`, so there are no
+app-local Core Server Actions or action maps.
+
+The API resolves Better Auth sessions from the incoming Request headers.
+Cookie-authenticated JSON mutations require a same-origin `Origin` header and
+continue through the existing Core permission checks. Better Auth itself stays
+on its separate `/api/auth/[...all]` route. Plugin actions remain generated in
+[`app/hackkit-plugin-actions.ts`](app/hackkit-plugin-actions.ts) by
+`hackkit plugin sync`; they are deliberately outside the Core UI API registry.
 
 ## Configuration
 

apps/test-web/app/api/hackkit/[...all]/route.ts

@@ -0,0 +1,7 @@
+import { toNextJsHandler } from "@hackkit/next";
+import { getRuntime } from "@/lib/runtime";
+
+const handler = async (request: Request) => (await getRuntime()).api.handler(request);
+
+export const { GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS } =
+	toNextJsHandler(handler);

apps/test-web/app/providers.tsx

@@ -1,20 +1,22 @@
+"use client";
+
 import { HackKitUIProvider } from "@hackkit/ui";
 import type * as React from "react";
-import { hackKitUIActions } from "./_hackkit/ui-action-map";
+import { createHackkitUIActionsClient } from "@hackkit/next/client";
 
 /**
- * Wires Core mutations through HackKit actions. Those actions import the app
- * runtime before resolving a mutation, which is required for Server
- * Action requests that do not execute a page module first.
+ * Core UI actions use the typed Better Call client. Authentication stays in
+ * the incoming cookie request handled by `/api/hackkit`; no Server Action
+ * references or app-maintained action map are serialized to the browser.
  *
  * Do not pass `DEFAULT_HACKKIT_UI_ROUTES` (or any map with route builder
- * functions) from this Server Component — those builders are not serializable.
+ * functions) through this Client Component — those builders are not serializable.
  * Omit `routes` to use the client-side defaults, or pass only string overrides.
  * For custom admin builders, supply a client `navigation` adapter instead.
  */
 export function Providers({ children }: { children: React.ReactNode }) {
 	return (
-		<HackKitUIProvider actions={hackKitUIActions}>
+		<HackKitUIProvider actions={createHackkitUIActionsClient()}>
 			{children}
 		</HackKitUIProvider>
 	);

apps/test-web/lib/runtime.ts

@@ -15,6 +15,8 @@ const runtimePromise = createHackkitRuntimeFromConfig({
 	config: appConfig,
 	database: db,
 	auth: betterAuthAdapter({ auth, logger: getAppLogger() }),
+	resolveSession: (requestHeaders) =>
+		auth.api.getSession({ headers: requestHeaders }),
 	afterCurrentUser: async (user, hackkit) => {
 		await provisionOwnerFromAllowlist(hackkit, user);
 	},