create-ailk 0.18.0 → 0.19.0

package/templates/apps/api/src/middleware/auth.ts

@@ -33,10 +33,19 @@
  *      (`lib/hub-sign-in-store.ts`). It is admitted only beside the SAME
  *      spoke's key (`x-ailk-spoke-key`), only while its grant is unrevoked and
  *      unexpired, its client enabled and its person's email verified, and only
- *      on `HUB_SESSION_ROUTES` — an exact list of four reads; any other route
- *      is 404 (never 403, so the account area's `read()` loads "nothing for
- *      this caller"). It acts as its person (`request.userId`) and carries
- *      `request.hubSession` — never `request.sessionTenant`.
+ *      on `HUB_SESSION_ROUTES` — an exact list of METHOD + registered URL
+ *      pairs — the credential's own `me` and the member routes, 18 in all
+ *      (#8220); any other route is 404 (never 403, so the account area's
+ *      `read()` loads "nothing for this caller"). It acts as its person
+ *      (`request.userId`) and carries `request.hubSession` — never
+ *      `request.sessionTenant` — and its request logger names the spoke
+ *      (`spokeId`). Each person is limited, at each spoke, to 60 requests and
+ *      10 writes a minute and 30 writes an hour — a fixed hour window from
+ *      the bucket's first admitted write (#8220 D2, SEC-8169-4): the bucket is
+ *      keyed on the VERIFIED spoke and person, never a header, and charged
+ *      only after every check above passes, so a refused credential or an
+ *      off-list route never gets one. The write limits refuse only writes,
+ *      and a request the budget refuses is not counted.
  *
  * Every authenticated request carries `request.actor` — the person, or the
  * agent and the person it acts for — and its request/reply loggers are
@@ -141,21 +150,39 @@ export type HubSession = {
 };
 
 /**
- * The only routes a hub-issued credential reaches (#7894 D6): an EXACT list of
- * method + registered URL, never a prefix, so a route added later joins only
- * by a reviewed edit of this list (SEC-7894-3). The first is the credential's
- * own `me`; the other three are #7877's member reads. Not admitted,
- * deliberately: `GET /v1/waitlist-signups/me`, `GET /v1/flow-checkouts/me`,
- * `GET /v1/subscription/me` and `POST /v1/subscription/portal-session` (they
- * answer for the HUB's site and the person's platform billing, SEC-7894-1,
- * -2), and the token and profile routes.
+ * The only routes a hub-issued credential reaches (#7894 D6, #8220 D1): an
+ * EXACT list of method + registered URL, never a prefix and never computed,
+ * so a route added later joins only by a reviewed edit of this list
+ * (SEC-7894-3). Three groups, in this order: the credential's own `me` and
+ * #7877's three member reads; #8169's eight member reads; #8170's six member
+ * writes (roadmap §7.2 row order). The member profile write IS admitted — it
+ * is the person's own account, which roadmap D9 saves through it. Not
+ * admitted, deliberately: `GET /v1/waitlist-signups/me`,
+ * `GET /v1/flow-checkouts/me`, `GET /v1/subscription/me` and
+ * `POST /v1/subscription/portal-session` (they answer for the HUB's site and
+ * the person's platform billing, SEC-7894-1, -2), the token routes and the
+ * hub's own-account `/v1/user/*` routes, `PATCH /v1/user/profile` among them.
  */
-export const HUB_SESSION_ROUTES: readonly string[] = [
+export const HUB_SESSION_ROUTES: readonly string[] = Object.freeze([
   "GET /v1/hub-sign-in/me",
   "GET /v1/member/pieces",
   "GET /v1/member/messages",
   "GET /v1/member/messages/:id/file",
-];
+  "GET /v1/member/purchases",
+  "GET /v1/member/appointments",
+  "GET /v1/member/artifacts",
+  "GET /v1/member/artifacts/:pieceId/versions/:version/file",
+  "GET /v1/member/meeting-types",
+  "GET /v1/member/availability",
+  "GET /v1/member/request-form",
+  "GET /v1/member/billing",
+  "POST /v1/member/artifacts/:pieceId/review",
+  "POST /v1/member/bookings",
+  "POST /v1/member/requests",
+  "POST /v1/member/messages",
+  "PATCH /v1/member/profile",
+  "POST /v1/member/deletion-request",
+]);
 
 /**
  * Who made a request (#3591 D9). A cookie session and a personal `ApiToken`
@@ -311,12 +338,13 @@ function bindActor(
   reply.log = request.log;
 }
 
-// ── The per-agent limit (#3591 D4 step 5, SEC-3591-04/-14) ─────────────────
+// ── The per-caller limits (#3591 D4 step 5, SEC-3591-04/-14; #8220 D2) ──────
 //
 // In the handler, not `onRequest`: the shared limiter runs before any
-// identity exists, and a bucket must only ever be keyed on a VERIFIED agent
-// id, so an invented key never gets one. The shape of
-// `routes/subscription/portal.ts`'s per-user budget.
+// identity exists, and a bucket must only ever be keyed on a VERIFIED id, so
+// an invented key or credential never gets one. The shape of
+// `routes/subscription/portal.ts`'s per-user budget. An agent and a person
+// never share a map.
 
 const AGENT_WINDOW_MS = 60_000;
 const AGENT_REQUESTS_PER_WINDOW = 60;
@@ -324,53 +352,159 @@ const AGENT_WRITES_PER_WINDOW = 10;
 /** Cap on distinct buckets — the oldest is evicted at capacity (DEF-011's shape). */
 const MAX_AGENT_BUCKETS = 5_000;
 
-type AgentBucket = { windowStartMs: number; requests: number; writes: number };
-const agentBuckets = new Map<string, AgentBucket>();
+const HUB_SESSION_WINDOW_MS = 60_000;
+const HUB_SESSION_REQUESTS_PER_WINDOW = 60;
+const HUB_SESSION_WRITES_PER_WINDOW = 10;
+const HUB_SESSION_WRITE_HOUR_MS = 3_600_000;
+const HUB_SESSION_WRITES_PER_HOUR = 30;
+const MAX_HUB_SESSION_BUCKETS = 5_000;
+
+type CallerBucket = {
+  windowStartMs: number;
+  requests: number;
+  writes: number;
+  /** The hourly write window — set by the bucket's first admitted write. */
+  hourStartMs: number | null;
+  hourWrites: number;
+};
+
+type CallerLimits = {
+  windowMs: number;
+  maxBuckets: number;
+  requests: number;
+  writes: number;
+  /** An hourly write ceiling — the hub-credential path's alone. */
+  writesPerHour?: { limit: number; windowMs: number };
+  /** When true, the write limits refuse only writes; a read meets only `requests`. */
+  refuseOnlyWrites: boolean;
+  /** When true, a refused request still counts toward every limit. */
+  countRefused: boolean;
+};
+
+const AGENT_LIMITS: CallerLimits = {
+  windowMs: AGENT_WINDOW_MS,
+  maxBuckets: MAX_AGENT_BUCKETS,
+  requests: AGENT_REQUESTS_PER_WINDOW,
+  writes: AGENT_WRITES_PER_WINDOW,
+  refuseOnlyWrites: false,
+  countRefused: true,
+};
+
+const HUB_SESSION_LIMITS: CallerLimits = {
+  windowMs: HUB_SESSION_WINDOW_MS,
+  maxBuckets: MAX_HUB_SESSION_BUCKETS,
+  requests: HUB_SESSION_REQUESTS_PER_WINDOW,
+  writes: HUB_SESSION_WRITES_PER_WINDOW,
+  writesPerHour: {
+    limit: HUB_SESSION_WRITES_PER_HOUR,
+    windowMs: HUB_SESSION_WRITE_HOUR_MS,
+  },
+  refuseOnlyWrites: true,
+  countRefused: false,
+};
+
+const agentBuckets = new Map<string, CallerBucket>();
+const hubSessionBuckets = new Map<string, CallerBucket>();
 
 /** Test-only reset. Not intended for production use. */
 export function __resetAgentRateBuckets(): void {
   agentBuckets.clear();
 }
 
+/** Test-only reset. Not intended for production use. */
+export function __resetHubSessionRateBuckets(): void {
+  hubSessionBuckets.clear();
+}
+
 function isWrite(method: string): boolean {
   const m = method.toUpperCase();
   return m !== "GET" && m !== "HEAD";
 }
 
-/** `undefined` when admitted; the seconds to wait when the agent is over budget. */
-function chargeAgentRateLimit(
-  agentId: string,
+/** A bucket no window still holds — the eviction pass may drop it. */
+function isStale(
+  bucket: CallerBucket,
+  now: number,
+  limits: CallerLimits,
+): boolean {
+  if (now - bucket.windowStartMs < limits.windowMs) return false;
+  return (
+    bucket.hourStartMs === null ||
+    limits.writesPerHour === undefined ||
+    now - bucket.hourStartMs >= limits.writesPerHour.windowMs
+  );
+}
+
+/**
+ * Charge one request to `key`'s bucket. `undefined` when admitted; the
+ * seconds to wait — to the end of the latest window that refused, at least
+ * 1 — when over budget.
+ */
+function chargeCallerBucket(
+  buckets: Map<string, CallerBucket>,
+  key: string,
   method: string,
   now: number,
+  limits: CallerLimits,
 ): number | undefined {
-  let bucket = agentBuckets.get(agentId);
-  if (!bucket || now - bucket.windowStartMs >= AGENT_WINDOW_MS) {
-    if (!agentBuckets.has(agentId) && agentBuckets.size >= MAX_AGENT_BUCKETS) {
-      for (const [id, b] of agentBuckets) {
-        if (now - b.windowStartMs >= AGENT_WINDOW_MS) agentBuckets.delete(id);
+  let bucket = buckets.get(key);
+  if (!bucket || now - bucket.windowStartMs >= limits.windowMs) {
+    if (!bucket && buckets.size >= limits.maxBuckets) {
+      for (const [k, b] of buckets) {
+        if (isStale(b, now, limits)) buckets.delete(k);
       }
-      if (agentBuckets.size >= MAX_AGENT_BUCKETS) {
-        const oldest = agentBuckets.keys().next().value;
-        if (oldest !== undefined) agentBuckets.delete(oldest);
+      if (buckets.size >= limits.maxBuckets) {
+        const oldest = buckets.keys().next().value;
+        if (oldest !== undefined) buckets.delete(oldest);
       }
     }
-    // Re-insert, so Map order stays oldest-window-first for the eviction above.
-    agentBuckets.delete(agentId);
-    bucket = { windowStartMs: now, requests: 0, writes: 0 };
-    agentBuckets.set(agentId, bucket);
+    // Re-insert, so Map order stays oldest-window-first for the eviction
+    // above. A new minute keeps the hour's start and count.
+    buckets.delete(key);
+    bucket = {
+      windowStartMs: now,
+      requests: 0,
+      writes: 0,
+      hourStartMs: bucket?.hourStartMs ?? null,
+      hourWrites: bucket?.hourWrites ?? 0,
+    };
+    buckets.set(key, bucket);
   }
-  bucket.requests += 1;
-  if (isWrite(method)) bucket.writes += 1;
+  const hour = limits.writesPerHour;
   if (
-    bucket.requests > AGENT_REQUESTS_PER_WINDOW ||
-    bucket.writes > AGENT_WRITES_PER_WINDOW
+    hour !== undefined &&
+    bucket.hourStartMs !== null &&
+    now - bucket.hourStartMs >= hour.windowMs
   ) {
-    return Math.max(
-      1,
-      Math.ceil((bucket.windowStartMs + AGENT_WINDOW_MS - now) / 1_000),
-    );
+    bucket.hourStartMs = null;
+    bucket.hourWrites = 0;
   }
-  return undefined;
+
+  const write = isWrite(method);
+  const requests = bucket.requests + 1;
+  const writes = bucket.writes + (write ? 1 : 0);
+  const hourWrites = bucket.hourWrites + (write ? 1 : 0);
+  const minuteEnd = bucket.windowStartMs + limits.windowMs;
+  const refusedUntil: number[] = [];
+  if (requests > limits.requests) refusedUntil.push(minuteEnd);
+  if (write || !limits.refuseOnlyWrites) {
+    if (writes > limits.writes) refusedUntil.push(minuteEnd);
+    if (write && hour !== undefined && hourWrites > hour.limit) {
+      refusedUntil.push((bucket.hourStartMs ?? now) + hour.windowMs);
+    }
+  }
+
+  const refused = refusedUntil.length > 0;
+  if (!refused || limits.countRefused) {
+    bucket.requests = requests;
+    bucket.writes = writes;
+    if (write && hour !== undefined) {
+      bucket.hourWrites = hourWrites;
+      bucket.hourStartMs ??= now;
+    }
+  }
+  if (!refused) return undefined;
+  return Math.max(1, Math.ceil((Math.max(...refusedUntil) - now) / 1_000));
 }
 
 /**
@@ -412,7 +546,13 @@ async function authenticateAgent(
     onBehalfOfUserId: personId,
   });
 
-  const retryAfter = chargeAgentRateLimit(agentId, request.method, now);
+  const retryAfter = chargeCallerBucket(
+    agentBuckets,
+    agentId,
+    request.method,
+    now,
+    AGENT_LIMITS,
+  );
   if (retryAfter !== undefined) {
     reply.code(429).header("Retry-After", String(retryAfter)).send(RATE_LIMITED);
     return;
@@ -440,7 +580,9 @@ async function authenticateAgent(
 /**
  * The hub-credential path (#7894 D6). The credential is never logged and
  * never echoed: every refusal is a fixed body. (1)-(3) failing is the one 401;
- * (4), the route not being on `HUB_SESSION_ROUTES`, is 404 with no handler run.
+ * (4), the route not being on `HUB_SESSION_ROUTES`, is 404 with no handler run;
+ * (5), the person over budget at this spoke (#8220 D2), is 429 with no
+ * handler run.
  */
 async function authenticateHubSession(
   request: FastifyRequest,
@@ -490,6 +632,24 @@ async function authenticateHubSession(
     workspaceId: spoke.workspaceId as Id<"workspace">,
   };
   bindActor(request, reply, { type: "user", userId: request.userId });
+  // #8220 D10 — every line the request logger writes after admission names
+  // the spoke that acted: its id, never its key or the credential. (Lines a
+  // helper writes through the module-level `logger` carry no request binding.)
+  request.log = request.log.child({ spokeId: spoke.id });
+  reply.log = request.log;
+
+  // (5) The verified (spoke, person) is within its budget.
+  const retryAfter = chargeCallerBucket(
+    hubSessionBuckets,
+    `${spoke.id}:${grant.userId}`,
+    request.method,
+    now,
+    HUB_SESSION_LIMITS,
+  );
+  if (retryAfter !== undefined) {
+    reply.code(429).header("Retry-After", String(retryAfter)).send(RATE_LIMITED);
+    return;
+  }
 }
 
 export type AuthPreHandlerOptions = {

package/templates/apps/api/src/routes/leads/index.ts

@@ -245,6 +245,10 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
         }
       }
 
+      // #8185 D3 — a spoke's same-origin relay marks every forwarded call.
+      // The mark can only remove the spoke-checkout marker, never grant it.
+      sourceMeta.relayed = request.headers["x-ailk-relayed"] !== undefined;
+
       const result = await routeLead(
         buildInput(kind, body, workspaceId),
         sourceMeta,

package/templates/apps/api/src/server.ts

@@ -228,9 +228,30 @@ const WORKSPACES_PEOPLE = "./routes/workspaces/people.js";
 const WORKSPACES_PIECES = "./routes/workspaces/pieces.js";
 const WORKSPACES_PLAN = "./routes/workspaces/plan.js";
 const WORKSPACES_MESSAGES_OUT = "./routes/workspaces/messages-out.js";
+// #8171 D8 — the workspace's Requests read (the inbound member rows), the
+// SAME scope.
+const WORKSPACES_REQUESTS = "./routes/workspaces/requests.js";
 // #7877 D11 — the member reads: auth only, under the SAME module predicate.
 const MEMBER_PIECES = "./routes/member/pieces.js";
 const MEMBER_MESSAGES = "./routes/member/messages.js";
+// #8169 D9 — the Phase 1 member reads. Five under the SAME predicate; the two
+// that reach services/scheduling/ under scheduling && (workspace ||
+// multi-tenant), because only the scheduling module delivers that directory.
+const MEMBER_PURCHASES = "./routes/member/purchases.js";
+const MEMBER_APPOINTMENTS = "./routes/member/appointments.js";
+const MEMBER_ARTIFACTS = "./routes/member/artifacts.js";
+const MEMBER_REQUEST_FORM = "./routes/member/request-form.js";
+const MEMBER_BILLING = "./routes/member/billing.js";
+const MEMBER_MEETING_TYPES = "./routes/member/meeting-types.js";
+const MEMBER_AVAILABILITY = "./routes/member/availability.js";
+// #8170 D11 — the member writes. Four under the tenancy predicate (the
+// message POST rides MEMBER_MESSAGES); the booking, which reaches
+// services/scheduling/, under scheduling && (workspace || multi-tenant).
+const MEMBER_REQUESTS = "./routes/member/requests.js";
+const MEMBER_ARTIFACT_REVIEW = "./routes/member/artifact-review.js";
+const MEMBER_PROFILE = "./routes/member/profile.js";
+const MEMBER_DELETION_REQUEST = "./routes/member/deletion-request.js";
+const MEMBER_BOOKINGS = "./routes/member/bookings.js";
 // #3591 PR-B — the agent seat's management routes and an agent's own
 // context, siblings of WORKSPACES_MEMBERS in the same workspace/multi-tenant
 // scope.
@@ -316,6 +337,11 @@ const SLICE_PLUGINS = {
     specifier: WORKSPACES_PIECES,
     load: () => import(WORKSPACES_PIECES),
   },
+  // #8171 D8 — the Requests read, the SAME scope.
+  workspaceRequestRoutes: {
+    specifier: WORKSPACES_REQUESTS,
+    load: () => import(WORKSPACES_REQUESTS),
+  },
   workspacePlanRoutes: {
     specifier: WORKSPACES_PLAN,
     load: () => import(WORKSPACES_PLAN),
@@ -333,6 +359,58 @@ const SLICE_PLUGINS = {
     specifier: MEMBER_MESSAGES,
     load: () => import(MEMBER_MESSAGES),
   },
+  // #8169 D9 — the Phase 1 member reads, in authScope beside the two above.
+  memberPurchaseRoutes: {
+    specifier: MEMBER_PURCHASES,
+    load: () => import(MEMBER_PURCHASES),
+  },
+  memberAppointmentRoutes: {
+    specifier: MEMBER_APPOINTMENTS,
+    load: () => import(MEMBER_APPOINTMENTS),
+  },
+  memberArtifactRoutes: {
+    specifier: MEMBER_ARTIFACTS,
+    load: () => import(MEMBER_ARTIFACTS),
+  },
+  memberRequestFormRoutes: {
+    specifier: MEMBER_REQUEST_FORM,
+    load: () => import(MEMBER_REQUEST_FORM),
+  },
+  memberBillingRoutes: {
+    specifier: MEMBER_BILLING,
+    load: () => import(MEMBER_BILLING),
+  },
+  // The two that reach services/scheduling/ (scheduling-owned, D9).
+  memberMeetingTypeRoutes: {
+    specifier: MEMBER_MEETING_TYPES,
+    load: () => import(MEMBER_MEETING_TYPES),
+  },
+  memberAvailabilityRoutes: {
+    specifier: MEMBER_AVAILABILITY,
+    load: () => import(MEMBER_AVAILABILITY),
+  },
+  // #8170 D11 — the member writes, in authScope beside the reads.
+  memberRequestRoutes: {
+    specifier: MEMBER_REQUESTS,
+    load: () => import(MEMBER_REQUESTS),
+  },
+  memberArtifactReviewRoutes: {
+    specifier: MEMBER_ARTIFACT_REVIEW,
+    load: () => import(MEMBER_ARTIFACT_REVIEW),
+  },
+  memberProfileRoutes: {
+    specifier: MEMBER_PROFILE,
+    load: () => import(MEMBER_PROFILE),
+  },
+  memberDeletionRequestRoutes: {
+    specifier: MEMBER_DELETION_REQUEST,
+    load: () => import(MEMBER_DELETION_REQUEST),
+  },
+  // The one that reaches services/scheduling/ (scheduling-owned, D11).
+  memberBookingRoutes: {
+    specifier: MEMBER_BOOKINGS,
+    load: () => import(MEMBER_BOOKINGS),
+  },
   // #3591 PR-B — the agent seat, the SAME scope.
   workspaceAgentRoutes: {
     specifier: WORKSPACES_AGENTS,
@@ -927,6 +1005,30 @@ export async function build() {
     if (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")) {
       await authScope.register(await sliceRoutePlugin("memberPieceRoutes"));
       await authScope.register(await sliceRoutePlugin("memberMessageRoutes"));
+      // #8169 D9 — the Phase 1 member reads, under the same predicate.
+      await authScope.register(await sliceRoutePlugin("memberPurchaseRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberAppointmentRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberArtifactRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberRequestFormRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberBillingRoutes"));
+      // #8170 D11 — the member writes, under the same predicate.
+      await authScope.register(await sliceRoutePlugin("memberRequestRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberArtifactReviewRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberProfileRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberDeletionRequestRoutes"));
+    }
+    // #8169 D9 — the two member reads that reach services/scheduling/, which
+    // only the scheduling module delivers: a scaffold with a tenancy module
+    // and no scheduling carries neither file, and one with scheduling and no
+    // tenancy module registers neither.
+    if (
+      isModuleEnabled("scheduling") &&
+      (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant"))
+    ) {
+      await authScope.register(await sliceRoutePlugin("memberMeetingTypeRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberAvailabilityRoutes"));
+      // #8170 D11 — the member booking, under the same predicate.
+      await authScope.register(await sliceRoutePlugin("memberBookingRoutes"));
     }
 
     // Tenant-guarded domain routes (multi-tenant module) — the tenant
@@ -1104,6 +1206,11 @@ export async function build() {
         await tenantScope.register(
           await sliceRoutePlugin("workspacePieceRoutes"),
         );
+        // #8171 D8 — the Requests read: the inbound member rows, behind
+        // `inbox-read`; the content only to a role holding `people-read`.
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceRequestRoutes"),
+        );
         await tenantScope.register(
           await sliceRoutePlugin("workspacePlanRoutes"),
         );

package/templates/apps/api/src/services/__tests__/lead-routing.test.ts

@@ -1198,6 +1198,64 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
     expect(planLines()).toEqual([]);
   });
 
+  // #8185 — the hub stores its conclusion that a lead is a spoke's live paid
+  // checkout (`Lead.spokeCheckout`): the plan rule's own predicate, plus "not
+  // relayed". An unmarked create names no `spokeCheckout` key at all.
+  const createData = () =>
+    (prisma.lead.create as jest.Mock).mock.calls[0][0].data as Record<string, unknown>;
+
+  it("a live spoke checkout lead is created with spokeCheckout true and still sets the plan once", async () => {
+    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
+    expect(createData()).toMatchObject({ spokeCheckout: true });
+    expect(setPlan).toHaveBeenCalledTimes(1);
+  });
+
+  it("the same lead relayed for a visitor is created with no spokeCheckout key and still sets the plan", async () => {
+    await routeLead(checkoutLead, { ...spokeMeta, relayed: true }, { idempotencyKey: KEY });
+    expect(createData()).not.toHaveProperty("spokeCheckout");
+    expect(setPlan).toHaveBeenCalledTimes(1);
+  });
+
+  it.each([
+    ["an anonymous lead (viaSpoke false)", checkoutLead, sourceMeta, KEY],
+    ["a test-mode session key", checkoutLead, spokeMeta, "cs_test_a1B2c3"],
+    [
+      "amountTotal 0",
+      { ...checkoutLead, payload: { ...checkoutLead.payload, amountTotal: 0 } },
+      spokeMeta,
+      KEY,
+    ],
+    [
+      "a negative amountTotal",
+      { ...checkoutLead, payload: { ...checkoutLead.payload, amountTotal: -5 } },
+      spokeMeta,
+      KEY,
+    ],
+    ["a key that is not a session id", checkoutLead, spokeMeta, "abcdefghijklmnop"],
+    ["no key", checkoutLead, spokeMeta, undefined],
+    ["source contact", { ...checkoutLead, source: "contact" }, spokeMeta, KEY],
+    [
+      "page contact",
+      { ...checkoutLead, payload: { ...checkoutLead.payload, page: "contact" } },
+      spokeMeta,
+      KEY,
+    ],
+    [
+      "a numeric offering",
+      { ...checkoutLead, payload: { ...checkoutLead.payload, offering: 42 } },
+      spokeMeta,
+      KEY,
+    ],
+  ] as const)("no spokeCheckout key in the create data for %s", async (_label, input, meta, key) => {
+    await routeLead(
+      input as typeof checkoutLead,
+      meta,
+      key === undefined ? {} : { idempotencyKey: key },
+    );
+    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
+    expect(createData()).not.toHaveProperty("spokeCheckout");
+  });
+
   it("an offering that is not a key after the strip logs skipped and makes no plan call", async () => {
     await routeLead(
       { ...checkoutLead, payload: { ...checkoutLead.payload, offering: "Wendi_Retainer!" } },

package/templates/apps/api/src/services/lead-routing.ts

@@ -63,6 +63,15 @@
  * `routeLead`'s result, and logs one bare `checkout-plan` line — never the
  * offering, the email or the key. A lead that does not qualify makes no
  * Person call at all.
+ *
+ * SPOKE CHECKOUT MARKER (#8185 D2). The same predicate, plus "not relayed
+ * for a visitor" (`SourceMeta.relayed`), is evaluated once BEFORE the lead's
+ * create and stored as `Lead.spokeCheckout` — the hub's conclusion at write
+ * time, which `GET /v1/member/purchases` serves as a purchase
+ * (`lib/member-store.ts`). Written only in the submit create below, never by
+ * an update; an unmarked create carries no `spokeCheckout` key at all and
+ * relies on the column default. The plan rule above is unchanged: it still
+ * runs after the write, from the same candidate.
  */
 
 import { randomUUID } from "node:crypto";
@@ -117,6 +126,13 @@ export type SourceMeta = {
    * `false`. Never persisted — `captureRecordFor` copies fields by name.
    */
   viaSpoke?: boolean;
+  /**
+   * The request carried `x-ailk-relayed`, i.e. it was forwarded for a
+   * visitor by a spoke's same-origin relay (#8185 D3). Absent reads as
+   * `false`. Never persisted. It can only REMOVE the spoke-checkout marker,
+   * never grant it.
+   */
+  relayed?: boolean;
 };
 
 /** Where the lead landed: a database row, the local file fallback, or the owner's inbox by email (#6730). */
@@ -340,9 +356,15 @@ async function persistToDb(
   input: RouteLeadInput,
   idempotencyKey?: string,
   viaSpoke = false,
+  relayed = false,
 ): Promise<PersistResult> {
   if (input.kind === "submit") {
     const personId = await resolveLeadPersonId(input);
+    // #8185 D2 — the plan rule's own predicate (pure: input, key, flag),
+    // evaluated before the create so its result can be stored. A relayed
+    // request is never a spoke's server call (D3).
+    const candidate = checkoutPlanCandidate(input, idempotencyKey, viaSpoke);
+    const spokeCheckout = candidate !== null && relayed !== true;
     let row: DbRow;
     try {
       row = (await prisma.lead.create({
@@ -371,6 +393,8 @@ async function persistToDb(
           // #852 D6 — the Person `resolveLeadPersonId` found or created.
           personId,
           ...(idempotencyKey !== undefined && { idempotencyKey }),
+          // #8185 D4 — only a marked create names the column.
+          ...(spokeCheckout && { spokeCheckout: true }),
         },
         select: { id: true },
       })) as DbRow;
@@ -386,7 +410,6 @@ async function persistToDb(
       return { ok: "keyed", outcome: classifyKeyedRow(winner, input) };
     }
     // #7877 D10 — only after THIS request's own write, so a replay sets nothing.
-    const candidate = checkoutPlanCandidate(input, idempotencyKey, viaSpoke);
     if (candidate !== null && personId !== null) {
       await applyCheckoutPlan(input, personId, candidate);
     }
@@ -729,7 +752,12 @@ export async function routeLead(
   let skipReason: string | undefined;
 
   try {
-    const dbResult = await persistToDb(input, idempotencyKey, sourceMeta.viaSpoke === true);
+    const dbResult = await persistToDb(
+      input,
+      idempotencyKey,
+      sourceMeta.viaSpoke === true,
+      sourceMeta.relayed === true,
+    );
     // #7869 D5 — a lost race answers like the lookup above: no capture
     // record, no notification.
     if (dbResult.ok === "keyed") return keyedResult(dbResult.outcome);

package/templates/apps/api/vercel.json

@@ -1,7 +1,7 @@
 {
   "version": 2,
-  "ignoreCommand": "git diff --quiet HEAD^ HEAD -- apps/api packages database",
-  "buildCommand": "cd ../.. && pnpm run --filter @ai-launch-kit/backend build:vercel",
+  "ignoreCommand": "[ -n \"$VERCEL_GIT_PREVIOUS_SHA\" ] && cd ../.. && git diff --quiet \"$VERCEL_GIT_PREVIOUS_SHA\" HEAD -- apps/api packages database pnpm-lock.yaml || exit 1",
+  "buildCommand": "cd ../.. && pnpm run --filter @working-theory/api build:vercel",
   "installCommand": "cd ../.. && pnpm install --frozen-lockfile",
   "outputDirectory": "public",
   "framework": null,

package/templates/apps/mcp/.env.example

@@ -58,6 +58,16 @@ MCP_ABUSE_CAPTURE_LEAD_DAILY_CAP=50
 # hosted Checkout Session, so the default is deliberately lower.
 MCP_ABUSE_START_PURCHASE_DAILY_CAP=20
 
+# Maximum number of create_booking calls per IP per day (#8071). Its own
+# budget — each call creates a real calendar event and emails the attendee an
+# invite, so the default matches start_purchase's.
+MCP_ABUSE_CREATE_BOOKING_DAILY_CAP=20
+
+# Maximum number of submit_flow_step calls per IP per day (#8071). Its own
+# budget, counted per step, not per flow — equal to capture_lead's, because a
+# one-step flow creates a Lead in one call.
+MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP=50
+
 # Comma-separated list of User-Agent substrings to block (case-insensitive).
 # Built-in list already blocks curl, wget, python-requests, scrapy, etc.
 # Add extra patterns here as needed.