create-ailk 0.19.0 → 0.19.1

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-livemode-live.test.ts

@@ -0,0 +1,159 @@
+/**
+ * POST /api/webhooks/stripe — the livemode guard, live-mode process (#8450
+ * D10; #6852 SEC-03). The mirror of `stripe-livemode.test.ts`.
+ *
+ * `lib/stripe.ts` runs as itself except `stripeKeyMode`, which answers
+ * `"live"` — the state `build()` leaves a process in after admitting a
+ * restricted live key. A signed event whose `livemode` is `false` (a
+ * test-mode event, forgeable by anyone holding the test key) is answered
+ * 200, writes nothing, is not marked seen and logs one `livemode_mismatch`
+ * warn; the same event with `livemode: true` reaches its arm.
+ *
+ * The stripe-site-filter.test.ts harness: the commerce claim mocked present,
+ * the prisma manual mock, the idempotency store reset per test.
+ */
+import type { FastifyInstance } from "fastify";
+import Fastify from "fastify";
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "pro",
+    plan: "pro-monthly",
+    features: ["commerce"],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+jest.mock("@working-theory/analytics/server", () => ({
+  track: jest.fn().mockResolvedValue(undefined),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../../lib/prisma.js");
+
+const mockVerifyWebhookSignature = jest.fn();
+jest.mock("@working-theory/stripe-client", () => ({
+  ...jest.requireActual("@working-theory/stripe-client"),
+  verifyWebhookSignature: (...args: unknown[]) => mockVerifyWebhookSignature(...args),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/stripe.js", () => ({
+  ...jest.requireActual("../../../lib/stripe.js"),
+  stripeKeyMode: () => "live",
+}));
+
+import * as configModule from "../../../config/index.js";
+import { prisma } from "../../../lib/prisma.js";
+import { __resetIdempotencyStore, hasSeen } from "../../../lib/webhook-idempotency.js";
+import { stripeWebhookHandler } from "../stripe.js";
+
+const EVENT_ID = "evt_livemode_12345678";
+
+function customerCreated(livemode: boolean) {
+  return {
+    id: EVENT_ID,
+    type: "customer.created",
+    livemode,
+    data: {
+      object: {
+        id: "cus_livemode_fixture",
+        email: "client@example.com",
+        metadata: { ailk_user_id: "usr_livemode" },
+      },
+    },
+  };
+}
+
+type LogCall = [unknown, string?];
+const logCalls: LogCall[] = [];
+
+async function buildTestServer(): Promise<FastifyInstance> {
+  const server = Fastify({ logger: false });
+  await server.register(async (webhooksScope) => {
+    webhooksScope.addContentTypeParser("application/json", { parseAs: "buffer" }, (_req, body, done) => {
+      done(null, body);
+    });
+    webhooksScope.addHook("onRequest", async (request) => {
+      for (const level of ["info", "warn", "error"] as const) {
+        const original = request.log[level].bind(request.log);
+        request.log[level] = ((...args: unknown[]) => {
+          logCalls.push(args as LogCall);
+          return (original as (...a: unknown[]) => void)(...args);
+        }) as typeof request.log.info;
+      }
+    });
+    webhooksScope.post("/v1/webhooks/stripe", stripeWebhookHandler);
+  });
+  await server.ready();
+  return server;
+}
+
+function mismatchLogs(): LogCall[] {
+  return logCalls.filter(
+    ([obj]) =>
+      typeof obj === "object" && obj !== null && (obj as Record<string, unknown>)["outcome"] === "livemode_mismatch",
+  );
+}
+
+let server: FastifyInstance;
+
+beforeEach(async () => {
+  jest.clearAllMocks();
+  logCalls.length = 0;
+  __resetIdempotencyStore();
+  jest.replaceProperty(configModule, "config", {
+    ...configModule.config,
+    STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
+  });
+  (prisma.user.findFirst as jest.Mock).mockResolvedValue(null);
+  (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
+  server = await buildTestServer();
+});
+
+afterEach(async () => {
+  await server.close();
+  jest.restoreAllMocks();
+});
+
+async function post() {
+  return server.inject({
+    method: "POST",
+    url: "/v1/webhooks/stripe",
+    payload: Buffer.from(JSON.stringify({ type: "test" })),
+    headers: { "content-type": "application/json", "stripe-signature": "t=1234,v1=abc" },
+  });
+}
+
+describe("stripe webhook — livemode guard in a live-mode process (#8450 D10)", () => {
+  it("drops a test-mode event: 200, no write, not marked seen, one warn", async () => {
+    mockVerifyWebhookSignature.mockReturnValue(customerCreated(false));
+
+    const res = await post();
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ received: true });
+    expect(prisma.user.findFirst).not.toHaveBeenCalled();
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
+    expect(prisma.user.update).not.toHaveBeenCalled();
+    expect(hasSeen(EVENT_ID)).toBe(false);
+    expect(mismatchLogs()).toHaveLength(1);
+    expect(mismatchLogs()[0]?.[0]).toEqual({
+      eventType: "customer.created",
+      eventIdPrefix: EVENT_ID.substring(0, 8),
+      outcome: "livemode_mismatch",
+    });
+  });
+
+  it("handles a live-mode event: it reaches its arm and is marked seen", async () => {
+    mockVerifyWebhookSignature.mockReturnValue(customerCreated(true));
+
+    const res = await post();
+
+    expect(res.statusCode).toBe(200);
+    expect(prisma.user.findFirst).toHaveBeenCalled();
+    expect(hasSeen(EVENT_ID)).toBe(true);
+    expect(mismatchLogs()).toHaveLength(0);
+  });
+});

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-livemode.test.ts

@@ -0,0 +1,158 @@
+/**
+ * POST /api/webhooks/stripe — the livemode guard, test-mode process (#8450
+ * D10; #6852 SEC-03).
+ *
+ * The real `lib/stripe.ts` runs over the package mocked for
+ * `verifyWebhookSignature` only, and nothing admits a live key, so the
+ * process is in test mode: a signed event whose `livemode` is `true` is
+ * answered 200, writes nothing, is not marked seen and logs one
+ * `livemode_mismatch` warn; the same event with `livemode: false` reaches
+ * its arm. The live-mode mirror is `stripe-livemode-live.test.ts`.
+ *
+ * The stripe-site-filter.test.ts harness: the commerce claim mocked present,
+ * the prisma manual mock, the idempotency store reset per test.
+ */
+import type { FastifyInstance } from "fastify";
+import Fastify from "fastify";
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "pro",
+    plan: "pro-monthly",
+    features: ["commerce"],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+jest.mock("@working-theory/analytics/server", () => ({
+  track: jest.fn().mockResolvedValue(undefined),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../../lib/prisma.js");
+
+const mockVerifyWebhookSignature = jest.fn();
+jest.mock("@working-theory/stripe-client", () => ({
+  ...jest.requireActual("@working-theory/stripe-client"),
+  verifyWebhookSignature: (...args: unknown[]) => mockVerifyWebhookSignature(...args),
+}));
+
+import * as configModule from "../../../config/index.js";
+import { prisma } from "../../../lib/prisma.js";
+import { stripeKeyMode } from "../../../lib/stripe.js";
+import { __resetIdempotencyStore, hasSeen } from "../../../lib/webhook-idempotency.js";
+import { stripeWebhookHandler } from "../stripe.js";
+
+const EVENT_ID = "evt_livemode_12345678";
+
+function customerCreated(livemode: boolean) {
+  return {
+    id: EVENT_ID,
+    type: "customer.created",
+    livemode,
+    data: {
+      object: {
+        id: "cus_livemode_fixture",
+        email: "client@example.com",
+        metadata: { ailk_user_id: "usr_livemode" },
+      },
+    },
+  };
+}
+
+type LogCall = [unknown, string?];
+const logCalls: LogCall[] = [];
+
+async function buildTestServer(): Promise<FastifyInstance> {
+  const server = Fastify({ logger: false });
+  await server.register(async (webhooksScope) => {
+    webhooksScope.addContentTypeParser("application/json", { parseAs: "buffer" }, (_req, body, done) => {
+      done(null, body);
+    });
+    webhooksScope.addHook("onRequest", async (request) => {
+      for (const level of ["info", "warn", "error"] as const) {
+        const original = request.log[level].bind(request.log);
+        request.log[level] = ((...args: unknown[]) => {
+          logCalls.push(args as LogCall);
+          return (original as (...a: unknown[]) => void)(...args);
+        }) as typeof request.log.info;
+      }
+    });
+    webhooksScope.post("/v1/webhooks/stripe", stripeWebhookHandler);
+  });
+  await server.ready();
+  return server;
+}
+
+function mismatchLogs(): LogCall[] {
+  return logCalls.filter(
+    ([obj]) =>
+      typeof obj === "object" && obj !== null && (obj as Record<string, unknown>)["outcome"] === "livemode_mismatch",
+  );
+}
+
+let server: FastifyInstance;
+
+beforeEach(async () => {
+  jest.clearAllMocks();
+  logCalls.length = 0;
+  __resetIdempotencyStore();
+  jest.replaceProperty(configModule, "config", {
+    ...configModule.config,
+    STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
+  });
+  (prisma.user.findFirst as jest.Mock).mockResolvedValue(null);
+  (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
+  server = await buildTestServer();
+});
+
+afterEach(async () => {
+  await server.close();
+  jest.restoreAllMocks();
+});
+
+async function post() {
+  return server.inject({
+    method: "POST",
+    url: "/v1/webhooks/stripe",
+    payload: Buffer.from(JSON.stringify({ type: "test" })),
+    headers: { "content-type": "application/json", "stripe-signature": "t=1234,v1=abc" },
+  });
+}
+
+describe("stripe webhook — livemode guard in a test-mode process (#8450 D10)", () => {
+  it("the process is in test mode", () => {
+    expect(stripeKeyMode()).toBe("test");
+  });
+
+  it("drops a live-mode event: 200, no write, not marked seen, one warn", async () => {
+    mockVerifyWebhookSignature.mockReturnValue(customerCreated(true));
+
+    const res = await post();
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ received: true });
+    expect(prisma.user.findFirst).not.toHaveBeenCalled();
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
+    expect(prisma.user.update).not.toHaveBeenCalled();
+    expect(hasSeen(EVENT_ID)).toBe(false);
+    expect(mismatchLogs()).toHaveLength(1);
+    expect(mismatchLogs()[0]?.[0]).toEqual({
+      eventType: "customer.created",
+      eventIdPrefix: EVENT_ID.substring(0, 8),
+      outcome: "livemode_mismatch",
+    });
+  });
+
+  it("handles a test-mode event as before: it reaches its arm and is marked seen", async () => {
+    mockVerifyWebhookSignature.mockReturnValue(customerCreated(false));
+
+    const res = await post();
+
+    expect(res.statusCode).toBe(200);
+    expect(prisma.user.findFirst).toHaveBeenCalled();
+    expect(hasSeen(EVENT_ID)).toBe(true);
+    expect(mismatchLogs()).toHaveLength(0);
+  });
+});

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-rate-limit.test.ts

@@ -60,6 +60,8 @@ jest.mock("../../../lib/stripe.js", () => ({
   verifyWebhookSignature: (...args: unknown[]) =>
     mockVerifyWebhookSignature(...args),
   StripeWebhookSignatureError: MockStripeWebhookSignatureError,
+  // #8450 D10 — the handler compares each event's livemode with this.
+  stripeKeyMode: () => "test",
 }));
 
 import { webhooksRoutes } from "../index.js";

package/templates/apps/api/src/routes/webhooks/stripe.ts

@@ -104,6 +104,7 @@ import {
   SITE_STAMP_KEY,
 } from "../../lib/site.js";
 import {
+  stripeKeyMode,
   StripeWebhookSignatureError,
   toSubscriptionLifecycleStatus,
   verifyWebhookSignature,
@@ -274,6 +275,22 @@ export const stripeWebhookHandler = async (
 
   const event = settled.event;
   const eventIdPrefix = event.id.substring(0, 8);
+
+  // #8450 D10 (#6852 SEC-03) — an event whose livemode is not the key class
+  // this process admitted is never one of its own: a live hub must not act on
+  // a test-mode event anyone with the test key can forge, nor a test hub on a
+  // live one. Dropped before the idempotency check and any write; 200 so
+  // Stripe stops retrying, and NOT marked seen, so a corrected deployment
+  // still accepts a redelivery.
+  if ((event.livemode === true) !== (stripeKeyMode() === "live")) {
+    request.log.warn(
+      { eventType: event.type, eventIdPrefix, outcome: "livemode_mismatch" },
+      "stripe webhook event dropped — livemode differs from the admitted key class",
+    );
+    await reply.code(200).send({ received: true });
+    return;
+  }
+
   request.log.info(
     { eventType: event.type, eventIdPrefix },
     "stripe webhook event received",

package/templates/apps/api/src/server.ts

@@ -55,6 +55,10 @@ import {
 import { tokenRoutes } from "./routes/auth/tokens.js";
 import { transactionalEmailRoute } from "./routes/auth/transactional-email.js";
 import { userRoutes } from "./routes/auth/user.js";
+import {
+  consentCookieRoute,
+  consentUnsubscribeRoute,
+} from "./routes/consent/index.js";
 import { getPageRoute } from "./routes/content/get-page.js";
 import { listPagesRoute } from "./routes/content/list-pages.js";
 import { listTypesRoute } from "./routes/content/list-types.js";
@@ -76,6 +80,7 @@ import {
   registerTestAuthRoute,
   shouldMountTestAuth,
 } from "./routes/test/auth/session.js";
+import { consentLinkSecretConfigured } from "./services/consent.js";
 
 /**
  * What a request looks like in a log line — Fastify's own default shape, minus
@@ -111,12 +116,18 @@ import {
  */
 const SESSION_ID_LOG_SEGMENT = /^cs_[A-Za-z0-9_]+$/;
 const LEAD_ID_LOG_SEGMENT = idRegex("lead");
+// #8438 SEC-8438-10 — a third arm for `person_…` segments. The consents route
+// (and every other `…/people/:personId…` route) would otherwise write a full
+// Person id into the request log line, beside `remoteAddress`.
+const PERSON_ID_LOG_SEGMENT = idRegex("person");
 
 function redactSensitiveIdSegments(url: string): string {
   return url
     .split("/")
     .map((segment) =>
-      SESSION_ID_LOG_SEGMENT.test(segment) || LEAD_ID_LOG_SEGMENT.test(segment)
+      SESSION_ID_LOG_SEGMENT.test(segment) ||
+      LEAD_ID_LOG_SEGMENT.test(segment) ||
+      PERSON_ID_LOG_SEGMENT.test(segment)
         ? `${segment.slice(0, 8)}…`
         : segment,
     )
@@ -252,6 +263,11 @@ const MEMBER_ARTIFACT_REVIEW = "./routes/member/artifact-review.js";
 const MEMBER_PROFILE = "./routes/member/profile.js";
 const MEMBER_DELETION_REQUEST = "./routes/member/deletion-request.js";
 const MEMBER_BOOKINGS = "./routes/member/bookings.js";
+// #8438 D6 — the member's own consents, under the tenancy predicate beside the
+// other member routes. D8 — the Admin owner's consents to Working Theory,
+// under multi-tenant alone (the module that contributes the Admin app).
+const MEMBER_CONSENTS = "./routes/member/consents.js";
+const CONSENT_PLATFORM = "./routes/consent/platform.js";
 // #3591 PR-B — the agent seat's management routes and an agent's own
 // context, siblings of WORKSPACES_MEMBERS in the same workspace/multi-tenant
 // scope.
@@ -406,6 +422,16 @@ const SLICE_PLUGINS = {
     specifier: MEMBER_DELETION_REQUEST,
     load: () => import(MEMBER_DELETION_REQUEST),
   },
+  // #8438 D6 — the member's own consents, the SAME scope as the writes above.
+  memberConsentRoutes: {
+    specifier: MEMBER_CONSENTS,
+    load: () => import(MEMBER_CONSENTS),
+  },
+  // #8438 D8 — the owner's consents to Working Theory (multi-tenant only).
+  consentPlatformRoutes: {
+    specifier: CONSENT_PLATFORM,
+    load: () => import(CONSENT_PLATFORM),
+  },
   // The one that reaches services/scheduling/ (scheduling-owned, D11).
   memberBookingRoutes: {
     specifier: MEMBER_BOOKINGS,
@@ -643,24 +669,29 @@ async function tenantPreHandlerForBuild(): Promise<FastifyPluginCallback> {
 }
 
 /**
- * The commerce boot-time sandbox guard — the one other slice entry that is
+ * The commerce boot-time key admission — the one other slice entry that is
  * not a route plugin, mirroring `tenantPreHandlerSlicePlugin()` above (D3).
- * `lib/stripe.ts` is commerce-owned (D5) and its `assertSandboxKey` is the
+ * `lib/stripe.ts` is commerce-owned (D5) and its `admitApiStripeKey` is the
  * sole `apps/api` reach into the Stripe SDK wrapper package, so it can no
  * longer be a static import (spec D1) once the module is stripped. The
  * widened `const specifier: string` annotation is what defeats `tsc`
  * resolution, exactly as it does above.
+ *
+ * #8450 D4: called with NO argument, so the admission covers the same
+ * `process.env` key `getStripeClient()` later reads. `STRIPE_MODE` unset is
+ * today's sandbox-only check; only a restricted live key beside
+ * `STRIPE_MODE=live` on a production build comes back `"live"`.
  */
-async function assertCommerceSandboxKey(key: string): Promise<void> {
+async function admitCommerceStripeKey(): Promise<"test" | "live"> {
   const specifier: string = "./lib/stripe.js";
   const mod = (await loadSlice(specifier, () => import(specifier))) as {
-    assertSandboxKey?: (key: string) => void;
+    admitApiStripeKey?: () => "test" | "live";
   };
-  const assertSandboxKeyFn = mod.assertSandboxKey;
-  if (!assertSandboxKeyFn) {
-    throw new Error("slice export assertSandboxKey missing from " + specifier);
+  const admitApiStripeKeyFn = mod.admitApiStripeKey;
+  if (!admitApiStripeKeyFn) {
+    throw new Error("slice export admitApiStripeKey missing from " + specifier);
   }
-  assertSandboxKeyFn(key);
+  return admitApiStripeKeyFn();
 }
 
 /**
@@ -676,6 +707,18 @@ async function assertCommerceSandboxKey(key: string): Promise<void> {
  * carries a localhost default.
  */
 function warnOnUnsetProductionProtections(): void {
+  // #8438 D9 — AILK_CONSENT_LINK_SECRET is optional, but a value shorter than
+  // 32 bytes is a misconfiguration worth an error at boot: it is treated as
+  // unset, so no unsubscribe link can be minted or honored. Never the value.
+  if (
+    process.env["AILK_CONSENT_LINK_SECRET"] !== undefined &&
+    process.env["AILK_CONSENT_LINK_SECRET"] !== "" &&
+    !consentLinkSecretConfigured()
+  ) {
+    logger.error(
+      "[startup] AILK_CONSENT_LINK_SECRET is set but shorter than 32 bytes — treated as unset; no unsubscribe link can be minted or honored",
+    );
+  }
   if (config.NODE_ENV !== "production") return;
   if (!process.env["FRONTEND_URL"]) {
     logger.warn(
@@ -713,14 +756,17 @@ export async function build() {
   // site renewed. Never throws; without DATABASE_URL the file store stays.
   await registerLicenseKeyStore();
 
-  // Runtime sandbox-mode guard: reject live-mode Stripe keys before any
-  // webhook or checkout call can exercise them. Idempotent — safe even if
-  // assertSandboxKey is called again inside a route handler. UNCONDITIONAL
-  // since D-64 (#5796): the commerce primitives and lib/stripe.ts are base
-  // tree now, so the key's presence — not a module flag — is the whole
-  // question. A build with no STRIPE_SECRET_KEY has nothing to assert.
+  // Runtime key admission (#8450 D4): refuse, before any webhook or checkout
+  // call can exercise it, every live Stripe key this process cannot vouch
+  // for — all of them unless STRIPE_MODE=live sits beside a restricted live
+  // key on a production build. UNCONDITIONAL since D-64 (#5796): the
+  // commerce primitives and lib/stripe.ts are base tree now, so the key's
+  // presence — not a module flag — is the whole question. A build with no
+  // STRIPE_SECRET_KEY has nothing to admit.
+  let stripeMode: "test" | "live" = "test";
   if (config.STRIPE_SECRET_KEY) {
-    await assertCommerceSandboxKey(config.STRIPE_SECRET_KEY);
+    stripeMode = await admitCommerceStripeKey();
+    logger.info({ stripeMode }, "[startup] stripe key admitted");
   }
 
   // trustProxy: true (#4730) — the Vercel serverless handler
@@ -933,6 +979,10 @@ export async function build() {
       await authScope.register(
         await sliceRoutePlugin("workspaceContextRoutes"),
       );
+      // #8438 D8 — the Admin owner's consents to Working Theory. Auth only,
+      // NOT tenant-guarded (the owner role is checked inside the route), and
+      // deliberately NOT in `HUB_SESSION_ROUTES`: a cookie session only.
+      await authScope.register(await sliceRoutePlugin("consentPlatformRoutes"));
     }
 
     // The leads INBOX read (#5678) — auth only, NOT tenant-guarded, for the
@@ -1016,6 +1066,8 @@ export async function build() {
       await authScope.register(await sliceRoutePlugin("memberArtifactReviewRoutes"));
       await authScope.register(await sliceRoutePlugin("memberProfileRoutes"));
       await authScope.register(await sliceRoutePlugin("memberDeletionRequestRoutes"));
+      // #8438 D6 — the member's own consents, under the same predicate.
+      await authScope.register(await sliceRoutePlugin("memberConsentRoutes"));
     }
     // #8169 D9 — the two member reads that reach services/scheduling/, which
     // only the scheduling module delivers: a scaffold with a tenancy module
@@ -1325,7 +1377,25 @@ export async function build() {
   // `GET /v1/checkout/sessions/:id` — the GET in its own nested,
   // rate-limited sub-scope (D16), so this preHandler applies to both while
   // the GET's own limiter applies to it alone.
+  //
+  // #8450 § 9 SEC-14 — a LIVE process gives both routes their own per-IP
+  // `checkout` bucket on top of the global limiter, because live, the public
+  // GET spends one read of the shared live Stripe account per request. It
+  // lowers the per-IP ceiling per instance (the POST's from the global 20 to
+  // 10; the POST and GET now also share one count); like every limiter here
+  // it is in-memory, so it does not bound the total across serverless
+  // instances. `onRequest`, so it counts before the claim gate. Accepted
+  // residual: a server-side caller — apps/web's server actions, an MCP host's
+  // `purchase` tool — puts all its buyers on its own egress IP, so they share
+  // one bucket; `AILK_RATE_LIMIT_CHECKOUT_PER_MINUTE` raises the ceiling. A
+  // test-mode process registers nothing new.
   await server.register(async (checkoutScope) => {
+    if (stripeMode === "live") {
+      await checkoutScope.register(rateLimitMiddleware, {
+        scope: "checkout",
+        perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      });
+    }
     checkoutScope.addHook("preHandler", requireCommerceClaim);
     await checkoutScope.register(await sliceRoutePlugin("checkoutRoutes"));
   });
@@ -1464,6 +1534,31 @@ export async function build() {
   // 10/min on form submissions. The global unauth ceiling above applies.
   await server.register(leadCaptureStatusRoute);
 
+  // The consent floor (#8438 D5, D9) — the cookie banner's log and the
+  // unsubscribe landing. Top level, outside every module gate: consent
+  // logging is part of the never-gated privacy floor. Each is in its OWN
+  // rate-limited scope (`consent`, `unsubscribe`) so filling one never blocks
+  // the other; with a forward key set, a spoke's visitors are counted one by
+  // one (both routes are on FORWARDED_VISITOR_ROUTES). Without one, the
+  // server's own IP is the bucket — the posture of the lead routes. Neither
+  // is behind `authScope`: the caller is a visitor, or a person in their mail.
+  await server.register(async (consentScope) => {
+    consentScope.register(rateLimitMiddleware, {
+      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      scope: "consent",
+      trustedKeyDigests: visitorForwardKeyDigests,
+    });
+    await consentScope.register(consentCookieRoute);
+  });
+  await server.register(async (unsubscribeScope) => {
+    unsubscribeScope.register(rateLimitMiddleware, {
+      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      scope: "unsubscribe",
+      trustedKeyDigests: visitorForwardKeyDigests,
+    });
+    await unsubscribeScope.register(consentUnsubscribeRoute);
+  });
+
   // Leads routes — rate-limit middleware scoped to this sub-router. Own
   // default (10/min, pre-#4730) rather than inheriting the wider
   // flows-sized default (#5111, DEF-004 — #4730's shared-default bump was