@bugmole/cli 0.4.0 → 0.5.0

package/src/registry-worker/features.ts

@@ -6,6 +6,7 @@ import "./jobs/retention.js";
 import "./ai/routes.js";
 import "./runner/routes.js";
 import "./signup/routes.js";
+import "./signup/attribution.js";
 import "./billing/checkout-routes.js";
 import "./notifications/outbox.js";
 import "./notifications/alerts.js";
@@ -14,6 +15,7 @@ import "./github/checks.js";
 import "./gitlab/checks.js";
 import "./personas/routes.js";
 import "./feedback/routes.js";
+import "./feedback/website.js";
 import "./devices/routes.js";
 import "./domains/routes.js";
 import "./sso/routes.js";

package/src/registry-worker/feedback/feedback.test.ts

@@ -228,3 +228,50 @@ test("a missing GitHub setup keeps the report and stops retrying", async () => {
   assert.equal((db.db.prepare("SELECT status FROM outbox").get() as any).status, "dead");
   assert.equal((db.db.prepare("SELECT status FROM feedback_reports WHERE id = ?").get(sent.json.id) as any).status, "new");
 });
+
+// ── The public website's "Questions?" panel ──
+
+const SITE = { origin: "https://bugmole.com", "cf-connecting-ip": "203.0.113.9" };
+
+test("website feedback is stored for triage, never filed on GitHub", async () => {
+  const gh = fakeGithub();
+  const { env, db } = feedbackEnv(gh);
+  const preflight = await call(env, "OPTIONS", "/api/public/feedback", { headers: { origin: "https://bugmole.com" } });
+  assert.equal(preflight.status, 204);
+  assert.equal(preflight.headers.get("access-control-allow-origin"), "https://bugmole.com");
+  const sent = await call(env, "POST", "/api/public/feedback", {
+    headers: SITE,
+    body: { topic: "question", message: "Does Bugmole test Flutter apps?", email: "ann@example.com", page: "https://bugmole.com/pricing/?token=abc" },
+  });
+  assert.equal(sent.status, 201);
+  assert.equal(sent.headers.get("access-control-allow-origin"), "https://bugmole.com");
+  const row = db.db.prepare("SELECT aegis_id, kind, category, contact, page, ip, github_issue_number FROM feedback_reports WHERE id = ?").get(sent.json.id) as any;
+  assert.deepEqual({ ...row }, { aegis_id: "website", kind: "feedback", category: "website:question", contact: "ann@example.com", page: redactUrl("https://bugmole.com/pricing/?token=abc"), ip: "203.0.113.9", github_issue_number: null });
+  await drainOutbox(env);
+  assert.equal(gh.state.issues.length, 0);
+});
+
+test("website feedback only from bugmole.com, and not from bots", async () => {
+  const { env, db } = feedbackEnv(fakeGithub());
+  const other = await call(env, "POST", "/api/public/feedback", { headers: { origin: "https://evil.example" }, body: { topic: "bug", message: "hello there" } });
+  assert.equal(other.status, 403);
+  const noOrigin = await call(env, "POST", "/api/public/feedback", { body: { topic: "bug", message: "hello there" } });
+  assert.equal(noOrigin.status, 403);
+  const bot = await call(env, "POST", "/api/public/feedback", { headers: SITE, body: { topic: "bug", message: "cheap pills", website: "http://spam" } });
+  assert.equal(bot.status, 201);
+  const bad = await call(env, "POST", "/api/public/feedback", { headers: SITE, body: { topic: "bug", message: "x" } });
+  assert.equal(bad.status, 422);
+  assert.equal((db.db.prepare("SELECT count(*) AS n FROM feedback_reports").get() as any).n, 0);
+});
+
+test("website feedback is rate limited per visitor", async () => {
+  const { env } = feedbackEnv(fakeGithub());
+  for (let i = 0; i < 5; i++) {
+    const ok = await call(env, "POST", "/api/public/feedback", { headers: SITE, body: { topic: "idea", message: `idea number ${i}` } });
+    assert.equal(ok.status, 201);
+  }
+  const limited = await call(env, "POST", "/api/public/feedback", { headers: SITE, body: { topic: "idea", message: "one more idea" } });
+  assert.equal(limited.status, 429);
+  const someoneElse = await call(env, "POST", "/api/public/feedback", { headers: { ...SITE, "cf-connecting-ip": "198.51.100.4" }, body: { topic: "idea", message: "a different person" } });
+  assert.equal(someoneElse.status, 201);
+});

package/src/registry-worker/feedback/website.ts

@@ -0,0 +1,77 @@
+// Questions and feedback from the public website (bugmole.com's "Questions?"
+// panel), from people who aren't signed in. They land in the same triage list
+// as dashboard reports (aegis_id "website"), but are never filed as GitHub
+// issues automatically: anyone on the internet can send one.
+import type { Env } from "../core.js";
+import { newId, response } from "../core.js";
+import { registerPublicRoutes } from "../routes/index.js";
+import { fingerprintOf, redactSecrets, redactUrl } from "./format.js";
+
+export const WEBSITE_AEGIS_ID = "website";
+/** Per visitor (IP) and for the whole site, per hour. */
+export const WEBSITE_IP_LIMIT_PER_HOUR = 5;
+export const WEBSITE_LIMIT_PER_HOUR = 100;
+const ALLOWED_ORIGINS = new Set(["https://bugmole.com"]);
+const KINDS = { question: "feedback", idea: "feedback", bug: "bug" } as const;
+
+function cors(origin: string | null): Record<string, string> {
+  return origin && ALLOWED_ORIGINS.has(origin)
+    ? { "access-control-allow-origin": origin, "access-control-allow-methods": "POST", "access-control-allow-headers": "content-type", "access-control-max-age": "86400", vary: "Origin" }
+    : {};
+}
+
+function withCors(res: Response, origin: string | null): Response {
+  const headers = new Headers(res.headers);
+  for (const [k, v] of Object.entries(cors(origin))) headers.set(k, v);
+  return new Response(res.body, { status: res.status, headers });
+}
+
+const text = (value: unknown, max: number) => (typeof value === "string" ? value.trim().slice(0, max) : "");
+const validEmail = (s: string) => /^[^\s@<>,;]+@[^\s@<>,;]+\.[^\s@<>,;]+$/.test(s);
+
+export async function submitWebsiteFeedback(request: Request, env: Env): Promise<Response> {
+  const origin = request.headers.get("origin");
+  if (!origin || !ALLOWED_ORIGINS.has(origin)) return response({ error: "Not allowed" }, 403);
+  const body = await request.json().catch(() => null) as Record<string, unknown> | null;
+  if (!body) return withCors(response({ error: "Send JSON" }, 400), origin);
+  // A field people never see: bots fill it in. Pretend it worked.
+  if (text(body.website, 200)) return withCors(response({ ok: true }, 201), origin);
+  const topic = text(body.topic, 20) as keyof typeof KINDS;
+  if (!(topic in KINDS)) return withCors(response({ error: "topic is question, idea or bug" }, 422), origin);
+  const message = text(body.message, 2_000);
+  if (message.length < 3) return withCors(response({ error: "Write a few words first" }, 422), origin);
+  const email = text(body.email, 200);
+  if (email && !validEmail(email)) return withCors(response({ error: "That email address doesn't look right" }, 422), origin);
+
+  const ip = request.headers.get("cf-connecting-ip");
+  const hourAgo = new Date(Date.now() - 3_600_000).toISOString().replace("T", " ").slice(0, 19);
+  const recent = await env.DB.prepare(`
+    SELECT count(*) AS total, SUM(CASE WHEN ip IS NOT NULL AND ip = ? THEN 1 ELSE 0 END) AS fromIp
+    FROM feedback_reports WHERE aegis_id = ? AND created_at > ?
+  `).bind(ip, WEBSITE_AEGIS_ID, hourAgo).first<{ total: number | null; fromIp: number | null }>();
+  if ((recent?.total ?? 0) >= WEBSITE_LIMIT_PER_HOUR || (ip && (recent?.fromIp ?? 0) >= WEBSITE_IP_LIMIT_PER_HOUR)) {
+    return withCors(response({ error: "Thanks, we've had a lot of messages just now. Please try again later, or ask on Discord." }, 429), origin);
+  }
+
+  const kind = KINDS[topic];
+  const page = text(body.page, 500) ? redactUrl(text(body.page, 500)) : null;
+  const clean = redactSecrets(message);
+  const id = newId("fb");
+  await env.DB.prepare(`
+    INSERT INTO feedback_reports (id, aegis_id, kind, category, message, page, contact, data_json, fingerprint, ip)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).bind(
+    id, WEBSITE_AEGIS_ID, kind, `website:${topic}`, clean, page, email || null,
+    JSON.stringify({ source: "website", userAgent: text(request.headers.get("user-agent"), 300) || undefined }),
+    await fingerprintOf(kind, clean, page, []), ip,
+  ).run();
+  return withCors(response({ ok: true, id }, 201), origin);
+}
+
+registerPublicRoutes(async ({ request, env, url }) => {
+  if (url.pathname !== "/api/public/feedback") return null;
+  const origin = request.headers.get("origin");
+  if (request.method === "OPTIONS") return new Response(null, { status: 204, headers: cors(origin) });
+  if (request.method !== "POST") return withCors(response({ error: "Not found" }, 404), origin);
+  return submitWebsiteFeedback(request, env);
+});

package/src/registry-worker/index.ts

@@ -184,10 +184,12 @@ async function claimDeviceAuthorization(request: Request, env: Env, principal: P
           ON CONFLICT(project_id, id) DO UPDATE SET name = excluded.name
         `).bind(attempt.projectId, attempt.projectName),
         env.DB.prepare(`
+          -- A project that already has an environment keeps it: pairing
+          -- another machine must not add a same-named twin beside it.
           INSERT INTO project_environments (id, project_id, app_id, name, base_url, status, is_default)
-          VALUES (?, ?, 'default', ?, '', 'active', 1)
-          ON CONFLICT(project_id, id) DO UPDATE SET app_id = excluded.app_id, name = excluded.name, is_default = 1
-        `).bind(environmentId, attempt.projectId, attempt.environment),
+          SELECT ?, ?, 'default', ?, '', 'active', 1
+          WHERE NOT EXISTS (SELECT 1 FROM project_environments WHERE project_id = ?)
+        `).bind(environmentId, attempt.projectId, attempt.environment, attempt.projectId),
         env.DB.prepare(`
           INSERT INTO project_memberships (project_id, aegis_id, role, status)
           VALUES (?, ?, 'owner', 'active')
@@ -234,9 +236,9 @@ async function claimDeviceAuthorization(request: Request, env: Env, principal: P
       `).bind(attempt.projectId, attempt.projectName),
       env.DB.prepare(`
         INSERT INTO project_environments (id, project_id, app_id, name, base_url, status, is_default)
-        VALUES (?, ?, 'default', ?, '', 'active', 1)
-        ON CONFLICT(project_id, id) DO UPDATE SET app_id = excluded.app_id, name = excluded.name, is_default = 1
-      `).bind(environmentId, attempt.projectId, attempt.environment),
+        SELECT ?, ?, 'default', ?, '', 'active', 1
+        WHERE NOT EXISTS (SELECT 1 FROM project_environments WHERE project_id = ?)
+      `).bind(environmentId, attempt.projectId, attempt.environment, attempt.projectId),
       env.DB.prepare(`
         INSERT INTO project_memberships (project_id, aegis_id, role, status)
         VALUES (?, ?, 'owner', 'active')
@@ -717,6 +719,11 @@ async function createEnvironment(
     "SELECT id FROM project_apps WHERE project_id = ? AND id = ?",
   ).bind(projectId, appId).first<{ id: string }>();
   if (!app) return response({ error: "App does not belong to this project" }, 422);
+  // Two environments with one name can't be told apart in the picker.
+  const sameName = await env.DB.prepare(
+    "SELECT id FROM project_environments WHERE project_id = ? AND COALESCE(app_id, 'default') = ? AND lower(trim(name)) = lower(?)",
+  ).bind(projectId, appId, body.name.trim()).first<{ id: string }>();
+  if (sameName) return response({ error: `This app already has an environment named "${body.name.trim()}" (${sameName.id})` }, 409);
   try {
     await env.DB.prepare(`
       INSERT INTO project_environments (id, project_id, app_id, name, base_url, api_url)
@@ -940,7 +947,7 @@ async function listRuns(env: Env, principal: Principal, projectId: string): Prom
            targets_json AS targetsJson, environment_base_url AS environmentBaseUrl,
            target_results_json AS targetResultsJson, fix_from_json AS fixFromJson,
            execution_mode AS executionMode, blocked_reason AS blockedReason, billed_minutes AS billedMinutes,
-           trigger_source AS triggerSource, repo_full_name AS repoFullName, commit_sha AS commitSha, pr_number AS prNumber,
+           trigger_source AS triggerSource, repo_full_name AS repoFullName, commit_sha AS commitSha, pr_number AS prNumber, check_run_id AS checkRunId,
            gitlab_binding_id AS gitlabBindingId
     FROM runs
     WHERE project_id = ? AND (? IS NULL OR COALESCE(completed_at, requested_at) >= ? OR status NOT IN ('success', 'partial', 'error', 'cancelled'))
@@ -1251,6 +1258,17 @@ async function fillDiscoveredEnvironmentUrl(env: Env, projectId: string, descrip
       .bind(origin, projectId, existing.id).run();
     return;
   }
+  // An environment that isn't marked default (made by hand, or by an older
+  // onboarding) is still the project's environment: promote it rather than
+  // add a second "Production" beside it.
+  const other = await env.DB.prepare(
+    "SELECT id, base_url AS baseUrl FROM project_environments WHERE project_id = ? ORDER BY rowid LIMIT 1",
+  ).bind(projectId).first<{ id: string; baseUrl: string }>();
+  if (other) {
+    await env.DB.prepare("UPDATE project_environments SET is_default = 1, base_url = CASE WHEN base_url = '' THEN ? ELSE base_url END WHERE project_id = ? AND id = ?")
+      .bind(origin, projectId, other.id).run();
+    return;
+  }
   const app = await env.DB.prepare("SELECT id FROM project_apps WHERE project_id = ? AND is_default = 1")
     .bind(projectId).first<{ id: string }>();
   if (!app) return;

package/src/registry-worker/org/routes.test.ts

@@ -26,11 +26,20 @@ test("an invitation emails a single-use link that adds the person with the invit
   const reused = await call(env, "POST", `/api/invitations/${token}/accept`, { as: "user_cal" });
   assert.equal(reused.status, 410);
 
-  const members = await call(env, "GET", `/api/workspaces/${workspaceId}/members`, { as: "user_bea" });
+  const members = await call(env, "GET", `/api/workspaces/${workspaceId}/members`, {
+    as: "user_bea",
+    // The dashboard forwards the signed-in email, which the registry remembers.
+    headers: { "x-aegis-email": "user_bea@example.com", "x-aegis-email-verified": "true" },
+  });
   assert.deepEqual(members.json.members.map((m: { aegisId: string; role: string }) => [m.aegisId, m.role]), [
     [owner, "owner"],
     ["user_bea", "member"],
   ]);
+  assert.equal(
+    members.json.members.find((m: { aegisId: string }) => m.aegisId === "user_bea")?.email,
+    "user_bea@example.com",
+    "people are listed by email, not their Aegis id",
+  );
   assert.deepEqual(members.json.invitations, [], "members don't see pending invitations");
 });
 
@@ -161,3 +170,17 @@ test("the audit log records changes; export needs the Business plan", async () =
   assert.match(csv.headers.get("content-type") ?? "", /text\/csv/);
   assert.match(String(csv.json), /"run\.created"/);
 });
+
+test("pairing a machine keeps a project's existing environment instead of adding a same-named twin", async () => {
+  const { env, db } = createTestEnv();
+  const fresh = await claimDevice(env, "user_pair", "shop", "Shop");
+  assert.equal(fresh.status, 200, JSON.stringify(fresh.json));
+  const first = db.db.prepare("SELECT id, is_default AS isDefault FROM project_environments WHERE project_id = 'shop'").all().map((row: any) => ({ ...row }));
+  assert.deepEqual(first, [{ id: "staging", isDefault: 1 }], "a brand-new project gets the CLI's environment");
+
+  db.db.prepare("UPDATE project_environments SET id = 'default', name = 'Production' WHERE project_id = 'shop'").run();
+  const again = await claimDevice(env, "user_pair", "shop", "Shop");
+  assert.equal(again.status, 200, JSON.stringify(again.json));
+  const after = db.db.prepare("SELECT id FROM project_environments WHERE project_id = 'shop'").all().map((row: any) => row.id);
+  assert.deepEqual(after, ["default"], "pairing again doesn't add a second environment");
+});

package/src/registry-worker/org/routes.ts

@@ -42,10 +42,11 @@ async function listMembers({ env, principal }: AuthedRouteContext, workspaceId:
   const role = await workspaceRole(env, principal.aegisId, workspaceId);
   if (!role) return response({ error: "Workspace scope is not allowed" }, 403);
   const members = await env.DB.prepare(`
-    SELECT aegis_id AS aegisId, role, status, invited_by AS invitedBy, created_at AS joinedAt
-    FROM workspace_memberships
-    WHERE workspace_id = ? AND status = 'active'
-    ORDER BY CASE role WHEN 'owner' THEN 0 WHEN 'admin' THEN 1 WHEN 'billing' THEN 2 ELSE 3 END, created_at
+    SELECT m.aegis_id AS aegisId, u.email, m.role, m.status, m.invited_by AS invitedBy, m.created_at AS joinedAt
+    FROM workspace_memberships m
+    LEFT JOIN aegis_users u ON u.id = m.aegis_id
+    WHERE m.workspace_id = ? AND m.status = 'active'
+    ORDER BY CASE m.role WHEN 'owner' THEN 0 WHEN 'admin' THEN 1 WHEN 'billing' THEN 2 ELSE 3 END, m.created_at
   `).bind(workspaceId).all();
   const canManage = role === "owner" || role === "admin";
   const invitations = canManage

package/src/registry-worker/runner/runner.test.ts

@@ -58,6 +58,9 @@ test("runner tokens name one run, can't be altered and expire", async () => {
   assert.equal(allowed("PUT", "/api/projects/shop/artifacts/object?key=projects/shop/plans/a.yaml"), false);
   assert.equal(allowed("PUT", "/api/projects/shop/artifacts/object?key=projects/shop/runs/run_1/video.webm"), true);
   assert.equal(allowed("PUT", "/api/projects/shop/artifacts/object?key=projects/shop/runs/run_10/video.webm"), false);
+  assert.equal(allowed("PUT", "/api/projects/shop/artifacts/object?key=projects/shop/journeys/graph.json"), true, "a passing run promotes the journey it proved");
+  assert.equal(allowed("PUT", "/api/projects/shop/artifacts/object?key=projects/shop/journeys/other.json"), false);
+  assert.equal(allowed("PUT", "/api/projects/other/artifacts/object?key=projects/other/journeys/graph.json"), false);
   assert.equal(allowed("GET", "/api/projects/other/artifacts"), false);
   assert.equal(allowed("GET", "/api/projects"), false);
   assert.equal(allowed("POST", "/api/tasks/run_1"), false);
@@ -214,6 +217,41 @@ test("a discovered URL fills a project's empty default environment but never ove
   }
 });
 
+test("a discovered URL makes an existing environment the default instead of adding a second Production", async () => {
+  const launcher = fakeLauncher();
+  try {
+    const { env, db, projectId, owner } = await cloudProject();
+    db.db.prepare(`
+      INSERT INTO project_environments (id, project_id, app_id, name, base_url, status, is_default)
+      VALUES ('production', ?, 'default', 'Production', '', 'active', 0)
+    `).run(projectId);
+    const created = await call(env, "POST", `/api/projects/${projectId}/tasks`, {
+      as: owner,
+      body: { title: "Explore https://shop.test", description: "Explore https://shop.test", taskType: "discovery", idempotencyKey: "d1", executionMode: "cloud" },
+    });
+    const taskId = created.json.task.id;
+    const { token } = launcher.launches[0];
+    await call(env, "POST", `/api/tasks/${taskId}`, { token, body: { workerId: `cloud:task:${taskId}`, status: "completed", completionSummary: "Explored 1 page" } });
+    const environments = db.db.prepare("SELECT id, base_url AS baseUrl, is_default AS isDefault FROM project_environments WHERE project_id = ?").all(projectId).map((row: any) => ({ ...row }));
+    assert.deepEqual(environments, [{ id: "production", baseUrl: "https://shop.test", isDefault: 1 }]);
+  } finally {
+    launcher.restore();
+  }
+});
+
+test("an app can't have two environments with the same name", async () => {
+  const { env, projectId, owner } = await cloudProject();
+  const create = (id: string, name: string) => call(env, "POST", `/api/projects/${projectId}/environments`, {
+    as: owner,
+    body: { id, name, baseUrl: "https://shop.test" },
+  });
+  assert.equal((await create("production", "Production")).status, 201);
+  const twin = await create("prod-2", " production ");
+  assert.equal(twin.status, 409);
+  assert.match(twin.json.error, /already has an environment named "production" \(production\)/);
+  assert.equal((await create("staging", "Staging")).status, 201);
+});
+
 test("runs and discovery share the workspace's parallel slots", async () => {
   const launcher = fakeLauncher();
   try {

package/src/registry-worker/runner/tokens.ts

@@ -78,7 +78,10 @@ export function runnerMayCall(identity: RunnerIdentity, method: string, url: URL
     if (path.startsWith(`/api/runs/${id}/device-sessions/`)) return method === "GET" || method === "POST";
     if (artifacts) {
       if (method === "GET") return true;
-      return (method === "PUT" || method === "DELETE") && key.startsWith(`projects/${project}/runs/${id}/`);
+      if ((method === "PUT" || method === "DELETE") && key.startsWith(`projects/${project}/runs/${id}/`)) return true;
+      // A passing run promotes the draft journey it proved (run-job.ts), so
+      // it may rewrite the graph, and only the graph, of its own project.
+      return method === "PUT" && key === `projects/${project}/journeys/graph.json`;
     }
     return false;
   }

package/src/registry-worker/signup/attribution.test.ts

@@ -0,0 +1,147 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { call, createTestEnv, seedProject } from "../testing/harness.js";
+import { normalizeAttribution } from "./attribution.js";
+
+const now = Date.parse("2026-09-25T12:00:00Z");
+
+test("attribution keeps only values that match the contract", () => {
+  const cleaned = normalizeAttribution({
+    ref: "  Partner_42 ",
+    utm_source: " newsletter ",
+    utm_medium: "email",
+    utm_campaign: "x".repeat(150),
+    utm_content: "line\nbreak",
+    utm_term: 7,
+    landing_path: "/pricing/?utm_source=newsletter#plans",
+    referrer_host: "News.Example.com",
+    first_seen_at: "2026-09-20T08:30:00.000Z",
+  }, now);
+  assert.deepEqual(cleaned, {
+    ref: "partner_42",
+    utm_source: "newsletter",
+    utm_medium: "email",
+    utm_campaign: "x".repeat(100),
+    utm_content: null,
+    utm_term: null,
+    landing_path: "/pricing/",
+    referrer_host: "news.example.com",
+    first_seen_at: "2026-09-20T08:30:00.000Z",
+  });
+
+  const invalid = normalizeAttribution({
+    ref: "bad code!",
+    utm_source: "ok",
+    landing_path: "//evil.test/path",
+    referrer_host: "www.bugmole.com",
+    first_seen_at: "2027-01-01T00:00:00Z",
+  }, now);
+  assert.equal(invalid?.ref, null);
+  assert.equal(invalid?.landing_path, null);
+  assert.equal(invalid?.referrer_host, null);
+  assert.equal(invalid?.first_seen_at, null);
+  assert.equal(invalid?.utm_source, "ok");
+
+  assert.equal(normalizeAttribution({ ref: "a".repeat(41) }, now), null);
+  assert.equal(normalizeAttribution({ referrer_host: "https://news.example.com/x" }, now), null);
+  assert.equal(normalizeAttribution({ first_seen_at: "2026-09-20T08:30:00Z" }, now), null, "a date alone says nothing");
+  assert.equal(normalizeAttribution({ landing_path: "/docs/", first_seen_at: "2025-01-01T00:00:00Z" }, now)?.first_seen_at, null);
+  assert.equal(normalizeAttribution([], now), null);
+  assert.equal(normalizeAttribution("ref=x", now), null);
+});
+
+test("the first touch is recorded once and never overwritten", async () => {
+  const { env, db } = createTestEnv();
+  const first = await call(env, "POST", "/api/attribution", {
+    as: "user_new",
+    body: { ref: "Partner", utm_campaign: "launch", landing_path: "/", referrer_host: "news.example.com", bogus: "ignored" },
+  });
+  assert.equal(first.status, 201, JSON.stringify(first.json));
+  assert.equal(first.json.recorded, true);
+
+  const second = await call(env, "POST", "/api/attribution", { as: "user_new", body: { ref: "other", utm_campaign: "later" } });
+  assert.equal(second.status, 200);
+  assert.deepEqual(second.json, { recorded: false, reason: "already_recorded" });
+
+  const row = db.db.prepare("SELECT ref, utm_campaign, utm_source, landing_path, referrer_host FROM signup_attribution WHERE aegis_id = ?").get("user_new");
+  assert.deepEqual({ ...row }, { ref: "partner", utm_campaign: "launch", utm_source: null, landing_path: "/", referrer_host: "news.example.com" });
+});
+
+test("an account older than a day can't be attributed", async () => {
+  const { env, db } = createTestEnv();
+  db.db.prepare("INSERT INTO aegis_users (id, created_at) VALUES ('user_old', datetime('now', '-3 days'))").run();
+  const result = await call(env, "POST", "/api/attribution", { as: "user_old", body: { ref: "partner" } });
+  assert.deepEqual(result.json, { recorded: false, reason: "account_too_old" });
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS n FROM signup_attribution").get()?.n, 0);
+});
+
+test("nothing usable, API keys and the dashboard service record nothing", async () => {
+  const { env, db } = createTestEnv();
+  const empty = await call(env, "POST", "/api/attribution", { as: "user_new", body: { ref: "no spaces allowed", utm_source: "   " } });
+  assert.deepEqual(empty.json, { recorded: false, reason: "nothing_to_record" });
+
+  const { owner, projectId } = await seedProject(env);
+  const key = await call(env, "POST", "/api/api-keys", { as: owner, body: { name: "ci", projectIds: [projectId] } });
+  const byKey = await call(env, "POST", "/api/attribution", { token: key.json.token, body: { ref: "partner" } });
+  assert.equal(byKey.status, 403);
+  const byService = await call(env, "POST", "/api/attribution", { as: "bugmole-dashboard-service", body: { ref: "partner" } });
+  assert.equal(byService.status, 403);
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS n FROM signup_attribution").get()?.n, 0);
+});
+
+function withScents(env: Record<string, unknown>, codes: string[]) {
+  env.SCENTS = {
+    fetch: async (url: string) => {
+      const code = decodeURIComponent(String(url).split("/public/ref/")[1] ?? "");
+      return new Response(JSON.stringify({ valid: codes.includes(code) }), { headers: { "content-type": "application/json" } });
+    },
+  };
+  return env;
+}
+
+test("a typed referral code credits a recent account once, and only real codes", async () => {
+  const { env, db } = createTestEnv();
+  withScents(env as unknown as Record<string, unknown>, ["jane"]);
+  db.db.prepare("INSERT INTO aegis_users (id, created_at) VALUES ('user_new', datetime('now', '-5 days'))").run();
+
+  const before = await call(env, "GET", "/api/attribution/me", { as: "user_new" });
+  assert.equal(before.json.ref, null);
+  assert.equal(before.json.canEnterCode, true);
+
+  const typo = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: "jan" } });
+  assert.equal(typo.status, 404);
+  const bad = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: "not a code!" } });
+  assert.equal(bad.status, 400);
+
+  const ok = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: " JANE " } });
+  assert.equal(ok.status, 201, JSON.stringify(ok.json));
+  assert.equal(db.db.prepare("SELECT ref FROM signup_attribution WHERE aegis_id = 'user_new'").get()?.ref, "jane");
+
+  const again = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: "jane" } });
+  assert.equal(again.status, 409);
+  const after = await call(env, "GET", "/api/attribution/me", { as: "user_new" });
+  assert.deepEqual([after.json.ref, after.json.canEnterCode], ["jane", false]);
+});
+
+test("a code fills in a campaign-only attribution but never replaces a code", async () => {
+  const { env, db } = createTestEnv();
+  withScents(env as unknown as Record<string, unknown>, ["jane", "bob"]);
+  await call(env, "POST", "/api/attribution", { as: "user_new", body: { utm_campaign: "launch" } });
+  const ok = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: "jane" } });
+  assert.equal(ok.status, 201);
+  const row = db.db.prepare("SELECT ref, utm_campaign FROM signup_attribution WHERE aegis_id = 'user_new'").get();
+  assert.deepEqual({ ...row }, { ref: "jane", utm_campaign: "launch" });
+  const swap = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: "bob" } });
+  assert.equal(swap.status, 409);
+});
+
+test("codes can't be added after 30 days, or when Scents can't be asked", async () => {
+  const { env, db } = createTestEnv();
+  db.db.prepare("INSERT INTO aegis_users (id, created_at) VALUES ('user_old', datetime('now', '-40 days'))").run();
+  const unreachable = await call(env, "POST", "/api/attribution/code", { as: "user_old", body: { code: "jane" } });
+  assert.equal(unreachable.status, 503);
+  withScents(env as unknown as Record<string, unknown>, ["jane"]);
+  const late = await call(env, "POST", "/api/attribution/code", { as: "user_old", body: { code: "jane" } });
+  assert.equal(late.status, 409);
+  assert.equal((await call(env, "GET", "/api/attribution/me", { as: "user_old" })).json.canEnterCode, false);
+});